Continuous discovery

What it is

A scheduler-driven port scan that runs against every target in your workspace, on a cadence you set per target. The scanner is RustScan (40,000 ports in seconds, then nmap-style probes for fingerprinting), parked behind a job queue so a misconfigured /16 doesn’t pin a worker.

What it produces

For every target you’ve added:

• A list of hosts that resolve / live inside the target’s scope
• For each host, every TCP port that answered the SYN
• A history of port-open / port-closed transitions so you can answer “what changed since last month”

What to use it for

• Tracking surface drift on a portfolio of internet-facing assets
• Catching new services exposed by a release / configuration change
• Building the input list every other capability (fingerprinting, CVE matching, AI validation) reads from

Why it matters

The single most expensive question a security team answers each quarter is “what do we even own that’s exposed right now?” Manual inventory drifts the moment someone ships a new service. Annual pen tests are a snapshot of a moving target. Continuous discovery is the load-bearing capability. Everything else is downstream of it.

Why it’s valuable

• Catches what you forgot. Acquisitions, abandoned EC2 instances, forgotten staging boxes. All show up in the first scan.
• Self-healing surface map. No tickets to remember to scan; no spreadsheets to keep in sync.
• Cost-bounded. Scan as wide as you want. The asset pool meters what you pay for, not what you discover.

How to use it

1. Admin → Targets → Add target (or use Add bulk to paste thousands of IPs / CIDRs / hostnames at once).
2. Pick the scan cadence: every 6 hours, daily, weekly. Default is 24 h with ±10% jitter so a fleet of targets doesn’t clock-align.
3. Optionally constrain to a maintenance window (see scan windows).
4. Discovery results land in Hosts / Services within seconds.

For internal networks (RFC1918), use the Internal Network Agent. The cloud scheduler explicitly skips RFC1918 because it can’t dial them; the agent runs scans inside the network on the same cadence.