A machine finds it. A person signs it. You fix it.
Two phases. The first agrees what is actually yours and runs once. The second runs until you cancel. Click any step to see what happens inside it.
- FriendlyFlare platform — automated
- FriendlyFlare analyst — a named human
- You
Onboarding
- Loop · New access widens discovery, so these three steps loop until the map stops growing.
Initial discovery
PlatformYou give us a company name and one domain. That is the whole input.
From there the platform draws the first map on its own: certificate transparency logs, DNS and reverse DNS, registrar and WHOIS records, cloud address ranges, code hosts, and whatever else is already public about you. Nothing is touched that is not already reachable from the internet, and you have granted nothing at this point.
It is deliberately the same starting position an attacker has — which is the only honest way to find out what an attacker can see.
What comes out of it A first inventory, usually including several things nobody on your side would have listed.
Analyst review
AnalystA named analyst goes through the machine’s map before you ever see it.
They drop false attributions — somebody else’s host that happens to share your registrar, a name that merely looks like yours — and they check what was found against the signed authorisation, so nothing outside the agreed scope goes further.
This is the step where the list stops being a guess. It is also why the first thing you receive is short enough to read.
What comes out of it A map that has survived a human, with the guesses marked as guesses.
Customer review
YouYou confirm what is yours, strike out what is not, and add the things we could not have seen from outside.
Then you grant read-only access where you want the deeper view: repositories, CI, cloud accounts. Each grant is optional and each one widens what discovery can reach — an internal staging environment is invisible from the public internet until you say it exists.
Every grant is covered by the scope agreement signed at onboarding, and widening the scope later is a signed change, not a support ticket.
What comes out of it An agreed, authorised asset list — the thing the rest of the service runs against.
Recurring cycle
- Loop · Fixes go back to the scans and are re-tested on deploy, never taken on trust.
- Loop · Regular discovery feeds new assets back to the scans, so the cycle never runs out of surface.
Attack scans
PlatformEvery asset on the agreed map is included in weekly attack runs, not tested just once a year.
Agents work one narrow brief at a time under a hard rule: prove it without breaking it. Auth bypass, exposed panels, IDOR, findings chained across hosts. Destructive classes are off by default and stay off unless you sign something specific, and everything is read-only, rate-limited and logged.
A candidate finding at this stage is a claim, not a verdict. Nobody has looked at it yet.
What comes out of it Candidate findings with the request, the response and a screenshot already attached.
Analyst triage
AnalystCandidates go to a human, who tries the ones that matter.
Roughly 70–90% are filed as noise and you never see them — not reachable, not exploitable, not yours. What survives gets a verdict with a name attached, which is what an auditor or a customer actually wants when they ask who reviewed it.
Nothing reaches you on an agent’s authority alone. That is the whole point of the step.
What comes out of it A small number of confirmed, reproducible findings, each signed by the person who confirmed it.
Reports
PlatformTwo reports out of one body of evidence, because two very different people are asking.
The management report is exposure, trend, what is past its SLA and whose name is on it. The technical report is the finding itself: the request and the response, the steps to reproduce, the re-test result.
Both are dated, both are exportable, and both are written to be handed straight to an auditor or a regulated customer without an editing pass first. Technical updates go out weekly; the management report summarizes the trend monthly. The remediation SLA is 3 days for critical findings and 14 days for high findings, and can be tailored to your organization.
What comes out of it Dated evidence per finding and per release. You can see both report formats in full on the platform page.
Remediation
YouFindings route to wherever the work actually happens — Jira, Linear, GitHub — with the evidence attached, whether the owner is your own team or the supplier who runs the box.
Where no fix exists yet, the workaround is recorded against the finding and the finding stays open. “Mitigated” is not “closed”, and the report says which one it is.
When you push, the fix is re-attacked rather than taken on trust.
What comes out of it Findings that close because they were re-tested, not because somebody ticked them.
Regular discovery
PlatformYour attack surface changes without asking you. A new subdomain, a certificate issued this morning, an environment somebody spun up for a demo, a supplier’s new endpoint.
So the map is redrawn on a schedule — every 3–7 days for the external surface — rather than at the start of a contract. Anything new joins the cycle at the next scan, and anything that disappears is recorded as gone rather than quietly dropped.
This is the step that makes the difference between a report and a service.
What comes out of it A map that is current today, not on the day you signed.
Phase one, at no cost, before you decide anything.
Give us a name and a domain and we will run the first two steps for free: the discovery, and a human checking it. You keep the map whether or not you go any further.