Offensive & Defensive
Security Tooling
Discover, analyse and reduce your exposure with Microsoft-native security data and open intelligence. Passive from three portal exports, or active with a scan engine behind it.
What answers from the internet
Azure public IPs, Defender's internet-facing devices and Entra's app and identity data in. Active mode adds a masscan → nmap → nuclei pipeline to find what is really listening.
Hold it against Defender
Every reachable address is compared with what Defender for Endpoint is actually watching, so coverage becomes a fact rather than an assumption.
Name the pair nobody else names
Addresses with no sensor that something is already answering on come first. Defender's exposure level and open ports decide the order.
Onboard, close or accept
Each finding ends in one of three actions: onboard the host, close the port, or record the acceptance. Exports go straight into the ticket.
Exposure Intelligence
Three Microsoft portal exports in, coverage answer out. No scan, no backend, one HTML file that never sends your data anywhere.
- Azure, Defender and Entra portal exports
- Addressable from the internet vs watched by Defender
- Names the hosts with no sensor that are already answering
- Runs entirely in your browser, works offline
Prioritize
Reduce
Sightline (Active Testing)
The scanning build of the same coverage question. Discovers what actually answers from the internet, then holds it against what Defender is watching, so an exposed host with no sensor is named rather than inferred.
- Passive and active modes from one console
- Targets sourced from Azure, Defender and Entra
- masscan → nmap → nuclei pipeline, egress via Azure westeurope
- Coverage gaps ranked by Defender's exposure level and open ports
Verify
Strengthen