CREST-Aligned Continuous Attack Surface Monitoring (ASM) for UK Businesses
Attack surface management is no longer an annual snapshot; it’s a continuous discipline. Our ASM service provides 24/7 external asset discovery, exposed-service detection, certificate monitoring, and credential-leak alerting. Sector-aware, analyst-validated, SOC-ready.
- Continuous 24/7 coverage
- Analyst-validated alerts
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
Imran SaghirProject Lead, SquareOne“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Dan WilcocksonCo-Founder, Celloriof an organisation’s public attack surface is unknown to the security team: shadow IT, M&A inheritance, forgotten subdomains, decommissioned-but-routable hosts.
Penetration testing is a snapshot. Attack surface management is continuous.
Annual pen tests show your security posture on the day of testing. The day after, a developer spins up a new subdomain. A team migrates a service to a new cloud account. An acquired company brings 200 unaudited domains. Your attack surface drifts. Real attackers find these gaps before your next pen test.
Our attack surface monitoring continuously discovers your external assets via Shodan, Censys, certificate transparency log mining, dark-web monitoring, and BGP-route observation. Every change is detected, validated by an analyst, and pushed to your SOC. Reports satisfy ISO 27001 Annex A.5.7 (Threat Intelligence), A.8.8 (vulnerability management), align with NCSC vulnerability management guidance, and provide DORA-acceptable evidence of continuous attack-surface awareness.
Discovery draws on Shodan, Censys, certificate-transparency log mining, dark-web monitoring, and BGP-route observation, so shadow IT, forgotten subdomains, and decommissioned-but-routable hosts surface before attackers reach them. The continuous record maps to ISO 27001 A.5.7 and A.8.8, NCSC vulnerability-management guidance, and DORA continuous attack-surface awareness.
CONTINUOUS COVERAGE AREAS
What Attack Surface Monitoring Covers
Twelve continuous monitoring streams: surface, deep, and dark web. Real-time alerts, analyst-validated.
Asset Discovery
Continuous discovery of new IPs, subdomains, cloud resources, SaaS apps, exposed admin panels: anything routable from the internet.
Certificate Transparency
Real-time monitoring of certificate transparency logs for newly-issued certs against your domain space: catches typosquats, supply-chain SaaS, and shadow IT.
Subdomain Takeover
Continuous dangling-DNS detection. New CNAME pointing to deprovisioned cloud resources flagged within 24 hours.
Credential Breach Corpus
Continuous cross-reference of company / employee email addresses against breach data corpus (BreachCompilation, Collection #1-5, COMB, recent dumps).
Exposed Services
Shodan / Censys monitoring for exposed RDP, SSH, VPN, RPC, databases, message queues: anything your firewall shouldn’t allow.
SSL/TLS Posture
Continuous monitoring of TLS configuration, expiring certs, weak ciphers, deprecated protocols, certificate-pinning gaps.
SaaS Footprint
Discovery of SaaS apps registered with your domain: Slack workspaces, Jira instances, Confluence pages, GitHub orgs.
Dark Web Mentions
Mentions of your brand, executives, infrastructure, or credentials on dark web forums, marketplaces, and Telegram cybercrime channels.
Brand Impersonation
Typosquat domains, fake social profiles, lookalike SaaS apps, phishing kits targeting your customers / employees.
BGP & DNS Drift
Monitoring for BGP hijacks, DNS hijacks, NS record drift, MX record changes: early warning of routing-level attacks.
M&A Asset Discovery
When you acquire a company, we automatically discover their public attack surface within 48 hours: accelerates due diligence.
Supplier Attack Surface
Optional monitoring of your top 50 suppliers: early warning of partner exposures that could affect you.
FOUR-PHASE METHODOLOGY
Attack Surface Monitoring: From Asset Discovery to SOC-Ready Alert
Continuous monitoring. Analyst-validated alerts. Real-time SOC integration. Never raw scanner noise.
Initial Discovery
Comprehensive asset baseline within 5 working days. Domains, IPs, cloud accounts, SaaS apps, supplier list, executive watchlist.
Continuous Collection
24/7 monitoring across discovery sources. Every change captured: new asset, exposed service, certificate issuance, breach mention.
Analyst Validation
Every alert reviewed by an analyst. False positives filtered. Severity assigned. Context enriched. SOC-ready output.
Real-Time Reporting
Critical alerts within 1-4 hours. Standard alerts within 24 hours. Weekly digest, monthly report, quarterly threat-actor briefing.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a fixed Attack Surface Monitoring quote in 24 hours
A fixed-price quote back in one business day, from a CREST-aligned monitoring analyst. No sales pipeline, no chasing.
- CREST and IASME accredited. Monitoring your auditors and clients already recognise.
- Real-time critical alerts within hours. Every alert reviewed by an analyst before it reaches you.
- Live alerts in your client portal in real time, not a four-week PDF.
- From £600/month, annual contract billed monthly. No setup surprises.
Dan WilcocksonCo-Founder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a CREST-aligned monitoring analyst.
- You approve the scope and we book a start date, usually within 24 hours.
- Live alerts land in your client portal in real time, each reviewed by an analyst before it reaches you.
Get your fixed Attack Surface Monitoring quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a CREST-aligned monitoring analyst.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
ASM Reports Mapped to Every Framework
ASM evidence accepted across compliance frameworks where continuous monitoring is a control requirement.
ISO 27001 A.5.7 + A.8.8
Threat Intelligence (A.5.7) and Vulnerability Management (A.8.8): ASM provides the continuous evidence ISO auditors increasingly require.
NCSC Vulnerability Management
Aligned to NCSC continuous vulnerability management guidance.
FCA / PRA Operational Resilience
ASM supports Important Business Service threat awareness and severe-but-plausible scenario monitoring.
NIS2 + DORA
Continuous attack-surface awareness is a DORA Article 9 requirement and supports NIS2 essential-services obligations.
SOC 2
CC7.4 incident detection: ASM provides continuous external posture awareness SOC 2 auditors expect.
Cyber Essentials Plus
ASM exceeds CE+ baseline and demonstrably supports overall cyber maturity scoring during recertification.
PRICING
Transparent Attack Surface Monitoring Pricing
A continuous subscription, scoped to your asset count and sector. The fuller monthly tiers are in the FAQ below.
Annual contract, billed monthly. Scoped to asset count + sector. One-off setup from £1,500.
BY SECTOR
Attack Surface Monitoring for Your Sector
Attack surface drift varies dramatically by sector. We tailor monitoring to your industry’s actual risk profile.
Fintech
FCA-regulated firms, Open Banking, payment APIs, PCI scoping.
Fintech sector pageSaaS
Multi-tenant isolation, SSO/SAML/OIDC, customer-data perimeter, SOC 2 evidence.
SaaS sector pageLaw
Privileged-data confidentiality, partner-tier scrutiny, SRA Cyber Standard alignment.
Law firm sector pageHealthcare
NHS DSPT, NHS DTAC, EHR integration, telehealth, patient-data PII.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, claims data, broker integrations, cyber underwriting evidence.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, SC-cleared testers available.
Public sector pageWHY EJN LABS
What You Actually Get
What distinguishes our service from automated scans and box-tick competitors.
Continuous 24/7 Discovery
Continuous 24/7 external asset discovery, real-time analyst-validated alerts, monthly threat reports, and quarterly briefings.
Discovery-First, Continuous
Most “ASM” tools rescan your existing asset list. We discover new assets continuously, including unknown subdomains, shadow IT, M&A inheritance, supplier exposures.
Analyst-Validated, Never Noise
Every alert is reviewed by an analyst before reaching you. Your SOC sees signal, not 10,000 IoCs to triage.
Real-Time SOC Integration
Critical alerts within 1-4 hours via Slack / Teams / SIEM. Weekly digest. Monthly report. Quarterly threat-actor briefing. Format tailored to your team.
UK CREST + IASME + ISO 27001 + ISO 9001
Independently accredited. Verifiable on the CREST marketplace. ASM deliverables align with NCSC vulnerability management guidance and ISO 27001 A.5.7 / A.8.8.
M&A & Supplier Watch
Provide an M&A target’s domain and we run accelerated 48-hour discovery; optional monitoring of your top 50 suppliers gives early warning of partner exposures.
FAQ
Frequently Asked
What is attack surface monitoring (ASM)?
Attack surface monitoring (also called attack surface management) is the continuous discovery, inventory, and analysis of an organisation’s external-facing assets. ASM finds shadow IT, forgotten subdomains, M&A inheritance, exposed services, and credential leaks before attackers exploit them.
How is ASM different from a one-off pen test?
A pen test is a point-in-time assessment. ASM is continuous. Your attack surface drifts daily: new subdomains, cloud resources, SaaS apps. ASM catches drift in real time. Most organisations combine ASM with annual pen testing for full coverage.
How quickly are alerts delivered?
Critical alerts (e.g., your company on a ransomware leak site, exposed RDP server appearing on Shodan) are delivered within 1-4 hours of analyst validation. Standard alerts within 24 hours. Weekly digest at agreed time. Monthly threat reports on a fixed cadence.
How much does ASM cost in the UK?
Baseline (SMB) £600-£1,200/month. Mid-market (most commonly commissioned) £1,200-£3,500/month. Enterprise £3,500+/month. Annual contracts with monthly billing. Setup fee of £1,500-£3,000 covers initial asset baseline and sector profiling.
Do you discover M&A targets?
Yes. When you provide an M&A target’s domain, we run an accelerated 48-hour discovery against their public attack surface. This dramatically accelerates cyber due diligence and gives the security team early visibility into inherited risk.
Does ASM include credential breach monitoring?
Yes. Continuous cross-reference of your company / employee email addresses against the breach data corpus (BreachCompilation, Collection #1-5, COMB, daily-updated breach feeds). Includes recent dumps within hours of disclosure.
Can ASM detect subdomain takeover?
Yes. Continuous dangling-DNS monitoring against your registered domain space. New CNAME records pointing to deprovisioned cloud resources (GitHub Pages, Heroku, S3, Azure CDN) flagged and validated within 24 hours.
Does ASM monitor cloud edge (AWS / Azure / GCP)?
Yes. ASM covers cloud edge surface: load balancers, public S3 / Blob containers, CloudFront origins, Lambda function URLs, API Gateway endpoints. Shadow cloud accounts (AWS sub-accounts, Azure subscriptions) often discovered through certificate transparency.
Can you integrate with our SIEM / SOC tools?
Yes. Alerts delivered via email, Slack, Microsoft Teams, ServiceNow, Jira, or custom webhook. For enterprise tier, direct integration with SIEM (Splunk, Sentinel, QRadar, Elastic) via API or syslog. STIX / TAXII supported.
Does ASM satisfy ISO 27001 A.5.7 and A.8.8?
Yes. ISO 27001:2022 introduced A.5.7 (Threat Intelligence) and updated A.8.8 (Vulnerability Management). Our ASM deliverables (sector profile, continuous monitoring records, alert workflow) support the evidence you present at ISO 27001 audit.
Can you also run pen tests against discovered assets?
Yes. We frequently combine ASM with annual external penetration testing: ASM discovers assets, then targeted pen testing validates exploitability. Bundled engagements typically save 15-20% versus separate contracts.
Do you sign NDAs?
Yes. Standard NDA before any sector profile or asset inventory is shared. We operate under a project-specific master agreement that includes data handling, intelligence-sharing protocols, and breach notification clauses.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed Attack Surface Monitoring quote in 24 hours
A CREST-certified ASM analyst will contact you within one business day with a fixed price, a realistic timeline, and the named consultant. No sales pipeline.
