What your perimeter publishes — and what actually guards it.
Two questions about the devices that make up and guard your network: do we know all of them, and is each one scanned? And what do our perimeter devices publish to the internet, and how well do they guard it? The module reads each device's own configuration through its management API, with a read-only credential.
Switches, routers, firewalls, WAFs and load balancers, with the profiling context that says what each one is and which of it is tier-0 — and which infrastructure is known to the network but not covered by vulnerability scanning.
Any-any permit rules that cross a zone boundary, permits that log nothing, permits with no security profile, a management interface reachable over plain HTTP, an unhealthy HA pair, stale threat content and a software train past the vendor's end of life. A rule that allows anything but only within one zone is not reported as an any-any permit — it opens nothing the firewall does not already allow — unless the device's own intrazone default denies, or could not be read.
Published services that only monitor instead of block, a production service in monitor mode while its non-production twin blocks, expired or legacy-TLS certificates, stale publications with no live backend, appliance defaults left in place — and an appliance that exposes a cloud credential to the read-only account it is read with.
A firewall or WAF that runs in the cloud is linked to the Azure virtual machines or Oracle Cloud instances it runs on, found by the address the appliance is managed on. The scan-coverage check then looks for every address those machines hold, so an appliance the scanner knows by another address is no longer reported as missing.
The network security group verdict for each published address and port, evaluated in priority order the way the cloud platform does — reusing what the Cloud module already collected.
For every hostname the perimeter publishes, one row that walks the path from the outside in — DNS and CDN, perimeter firewall, cloud access control, web application firewall, backend. Each hop reads permits, restricts, denies or not measured, and the row ends in one verdict: reachable, compensated, or not measured.
Each with the evidence behind it, not just a severity label.
A built-in explainer on every finding — what it is, why it matters, what to do.
Rolled up from the findings and trended over time.
Findings mapped to the framework controls they evidence.
A check that guesses produces false findings, and false findings teach a team to ignore the real ones. These are the places this module holds back.
Findings from this module evidence the asset-management, network-security, perimeter-protection, device-hardening and coverage control areas of every activated framework.
Licensed on its own, and on the same platform as every other module. We'll show you the answer — and what it would say it couldn't measure.