The asset-pool model
Why we count tracked hosts, not discovered hosts, and how to swap them.
Last updated May 24, 2026
Every other ASM tool we tested counts every host they scan against your seat limit. Add a /22 → blow past your quota → upgrade or stop scanning. We built around a different rule:
Discovery is free and unlimited. Only hosts you explicitly tick to monitor count against your asset cap.
That changes how you use the product.
Why the distinction matters
Most external attack surfaces have a long tail: a handful of production assets that genuinely matter, hundreds of internal-ish hosts that show up in your IP range but you don’t care about (dev boxes, parked subdomains, legacy DNS lingering on AWS), and a few new things that pop up every week.
A per-discovered-host meter penalises you for completeness. You either scan narrow (and miss things) or pay for noise. A per-monitored-host meter lets you scan wide and pick.
How to use it
-
Add ranges generously. Your entire CIDR allocation, every acquired subsidiary, every cloud account. Discovery is free; this is the right reflex.
-
Tick the prod-facing hosts. Whatever’s on the internet that you care about: the API gateway, the marketing site, the VPN concentrator. These count against your cap.
-
Leave the noise untracked. A dev box that pops up once a month? Discovered, available to swap in, but not consuming a slot.
-
Swap as you find things. When the next scan reveals something interesting (a new service on a previously-quiet host, a CVE on something you weren’t watching), untick a host that no longer matters and tick the new one. No fees, no plan changes.
Per-tier caps
| Tier | Tracked-host cap | Discovery cap |
|---|---|---|
| Free | 10 | unlimited |
| Starter | 100 | unlimited |
| Pro | 1,000 | unlimited |
| Business | 10,000 | unlimited |
| Enterprise | unlimited | unlimited |
The discovery side is rate-limited per worker, not per plan. A free-tier customer scanning a /22 just takes a bit longer to finish than an Enterprise customer scanning the same range.
What “monitored” actually means
A monitored host gets, on the configured schedule:
- Re-discovery (port sweep)
- Service fingerprinting (probe + banner)
- CVE matching against the full NVD corpus, version-gated (patched builds don’t false-positive) and ranked by CISA KEV + EPSS
- Change events into the feed (new service, gone service, new CVE)
- Eligibility for AI exploit validation
An untracked host gets none of those. The host row stays in the DB for the picker UI. It’s a row, not an active subscription.
Why not just charge per scan?
Predictability. Customers want to know what they’ll pay this month. Per-scan billing turns every dashboard refresh into a cost meeting. Per-monitored-host is the cleanest unit a CFO can sign off on.
(For the genuinely usage-priced thing, AI validation, we charge in real dollars with a per-run ceiling so a runaway agent can’t surprise you. See AI validation.)