See what's exposed in your internal systems
Deploy an agent inside your network to run payload-based tests on internal apps, APIs and staging environments, with no inbound firewall rules.
Where Internal Scanning fits
Every product runs on the same Discovery layer. Internal Scanning brings the payload-based testing from Application Scanning and API Scanning to the apps behind your firewall, through an agent in your network.
Discovery
The system of record for your attack surface. Every asset flows through Discovery, so assessments read from it and findings feed back into it.
How Internal Scanning works
Deploy an agent, not a network tunnel
Internal Scanning runs as a self-contained agent inside your network. Deploy it with our Terraform module for AWS or our Helm chart and point it at your internal apps. With the right people and credentials in place, setup is quick, and there are no inbound firewall rules to open.
- Terraform module for AWS, or a Helm chart
- Self-contained package with license keys included
- Updates delivered through our container registry
No inbound firewall rules
The agent only connects outbound, over HTTPS, to the Detectify cloud. Scans are orchestrated from the cloud, but the full scanning engine runs on the agent, on infrastructure you control. Only the findings, and the requests and responses needed to reproduce them, leave your network.
- Outbound-only HTTPS, with no inbound firewall changes
- The full scanning engine runs locally, not a thin proxy
- Encrypted in transit and at rest, with bring-your-own-key for enterprise
The same kind of testing, behind your firewall
Internal Scanning runs payload-based fuzzing tests from Application Scanning and API Scanning against web apps and APIs on your internal network, including staging environments. It covers the majority of our external fuzzing tests today. Record a login to test the parts behind authentication.
- Web apps, and APIs with an OpenAPI spec
- Recorded login for testing behind authentication
- Tests built by ethical hackers in the Crowdsource community
Check that your network segments are really separate
Deploy agents at different points in your network and scan the same target from each one. That shows whether an app you meant to isolate can be reached from a segment it shouldn't be.
- Scan one target from several vantage points
- Validate segmentation, for example between guest Wi-Fi and an admin VLAN
- Add agents to cover more of your network
Internal and external findings in one place
Findings from the agent use the same format as external scans and show up in the same dashboard and API as Surface Monitoring, Application Scanning and API Scanning. Send them to the tools your team already uses.
- Same dashboard and API as your external scans
- Scheduled or API-triggered scans
- Jira, ServiceNow, Slack, Microsoft Teams and 100s more via Workato
Where security teams put Internal Scanning to work
Staging environments
Test before it reaches production
Staging and pre-production apps aren't reachable from the internet, so external scanners can't test them. Put an agent next to them and find issues before you release.
Private apps
Test the tools your company runs on
Admin tools, HR portals and other internal apps often hold sensitive data. Point the agent at them, and record a login to test behind authentication too.
Network segmentation
Show that your segments are isolated
Scan the same app from agents in different network segments to check that critical apps can only be reached from where they should be.
Detectify has transformed how quickly we can spot and fix weaknesses before they’re exploited. By automating our defences, we are reducing the risk to the essential services millions of people rely on every day.
FAQs
Web apps and APIs on your internal network, including staging environments, with payload-based fuzzing tests from Application Scanning and API Scanning. It covers most of our external fuzzing tests today, and you can record a login to test behind authentication.
It uses the same payload-based approach as our external scanning. Findings come from sending real payloads to the target, not from version fingerprints or signatures. The tests are written by ethical hackers in the Crowdsource community and QA-reviewed before they run.
The agent is deployed with our Terraform module on AWS or our Helm chart. Place it in a network segment where it can reach the apps you want to test, and allow outbound HTTPS to the Detectify cloud. No inbound firewall rules are needed. For apps behind authentication, have login credentials ready. Hardware and network details are in the documentation.
It only tests the targets you give it, so it doesn't discover assets. It doesn't check fingerprinted technologies for known CVEs, test for subdomain takeover, or test client-side DOM issues. Anything the agent can't reach from where it's deployed isn't tested, so add agents to cover more segments.
Only the findings, and the requests and responses needed to reproduce them in the Detectify app. The scanning engine runs on the agent, and data is encrypted in transit and at rest. Enterprise plans can use bring-your-own-key encryption.
Both. The agent runs in your network, and orchestration, reporting and the dashboard run in the Detectify cloud.
Application Scanning tests apps that are reachable from the internet. Internal Scanning brings payload-based testing to apps and APIs that aren't, through an agent in your network. Findings from both show up in the same dashboard.
Internal Scanning is priced for enterprise, based on the number of internal apps plus a license fee that includes 2 to 3 agent deployments. Talk to sales.
Surface Monitoring
Finds the domains, subdomains, IPs and open ports you have on the internet, and recommends which apps need a deeper scan.
Learn more about Surface Monitoring
Application Scanning
Crawls and fuzzes the web apps you build, including single-page apps and the parts behind login.
Learn more about Application Scanning
API Scanning
Payload-based testing for REST and GraphQL APIs, driven by your OpenAPI spec or GraphQL schema, including prompt injection on AI endpoints.
Learn more about API ScanningDeploy an agent and start scanning
Payload-based testing for the internal apps and APIs that external scanners can’t reach.