From the internet to the vulnerable line
Inventory, correlation, exposure
Built from what you already have
Frequently asked questions
Where does the surface come from?
From data you already produce: the tech-stack graph from vulnetix analyze, the OpenAPI and Swagger files in your repositories, your cloud sweep, and your findings. Nothing new to deploy for the inventory.
Does Vulnetix scan or attack my hosts?
No. The surface is built from configuration and code you already give us. The one active check is liveness, which sends only a GET, HEAD or OPTIONS, with no credentials, to hosts you own or have authorized. It never sends attack traffic.
What makes a route "public, no auth"?
Only a security scheme declared as none, or a live response with no authentication challenge. A route whose authentication cannot be confirmed is shown as unknown, never as unauthenticated.
How do you reach an API spec behind a host?
You prove you own the host with a DNS record or a file, or authorize the check explicitly. Only then does Vulnetix look for the well-known spec paths, and every fetch is guarded against reaching internal addresses.