TLDReconbyBraveson
Start free trial

Continuous external attack surface management

Start with your domains. We'll find everything else.

TLDRecon maps your external attack surface and alerts you only when it matters.

Start your free 30-day trialSee how setup works
  • Built in Finland
  • Hosted in the EU
TLDRecon graph view tracing example-corp.fi through the staging subdomain and an IP address to an SSH service exposed on port 22, with a high-severity alert

Your external attack surface, mapped and monitored

See everything you expose, from your own domains to your suppliers', and get alerted when something changes.

TLDRecon subdomain list showing www, app, api and staging subdomains with hosting provider, technology stack and open ports

Continuous attack surface discovery

Add your domains and TLDRecon maps the rest of your external attack surface: related domains, subdomains and IP ranges. Connect your cloud providers with read-only access, and new public IPs and DNS zones are added to monitoring automatically.

TLDRecon alerts with a high-severity SSH exposure and a low-severity DMARC finding

Exposure and vulnerability prioritization

Detect open ports, exposed admin panels, databases and end-of-life software. Every finding is scored with CVSS, CISA KEV and EPSS, so you focus on what attackers actually exploit.

TLDRecon email security score C (65/100) with SPF, DMARC and DKIM results and a TLS certificate expiring in 9 days

Domain and email security

Detect subdomain takeovers, SPF, DKIM and DMARC gaps, DNS misconfigurations and secrets leaked in DNS records. Get alerted to DNS changes, domain transfers and expiring domains and certificates.

TLDRecon asset inventory with the company domain and two supplier domains tagged Supplier, one with a critical finding

Supply chain risk monitoring

Monitor your suppliers' and partners' domains with the same alerts as your own. Know when a partner becomes a risk before it becomes your problem, and support your NIS2 supply chain requirements.

Works with the tools you already use

Discover from

  • AWS
  • Microsoft Azure
  • Google Cloud
  • Cloudflare

Alert to

  • Email
  • Slack
  • Microsoft Teams
  • Webhook

How attack surface monitoring works

  1. 1

    Add your domains

    Your domains are all TLDRecon needs to get started. No agents, no installation. Optionally connect your cloud providers with read-only access.

  2. 2

    TLDRecon maps your attack surface

    Related domains, subdomains and IP ranges are discovered and scanned for exposures, vulnerabilities and misconfigurations, continuously. First results within an hour.

  3. 3

    Get alerted when it matters

    Findings are prioritized by real-world exploitation. Critical issues reach you instantly by email, Slack, Teams or webhook. Everything else arrives in a daily or weekly summary, grouped by root cause.

    TLDRecon alerts view with a high-severity SSH exposure and a low-severity DMARC finding

Frequently asked questions

What do I need to get started?

Just your domains. There are no agents to deploy and nothing to install. TLDRecon discovers the rest of your external attack surface from there.

Do I need to give TLDRecon access to my cloud environment?

No, it's optional. If you connect your cloud providers with read-only access, new public IPs and DNS zones are added to monitoring automatically.

How are findings prioritized?

Every finding is scored with CVSS, CISA KEV and EPSS, so you can focus on what attackers are actually exploiting.

How will I be alerted?

Critical issues reach you instantly by email, Slack, Teams or webhook. Everything else arrives in a daily or weekly summary, grouped by root cause.

Can I monitor my suppliers and partners?

Yes. You can monitor your suppliers' and partners' domains with the same alerts as your own, which also supports your NIS2 supply chain requirements.

How long is the free trial?

30 days.

Start your free 30-day trial

Add your domains and see what TLDRecon finds on your external attack surface.

Start free trial