Cortex Xpanse: See Your Internet-Facing Attack Surface Before Attackers Do

Cortex Xpanse is an external attack surface management solution that continuously discovers an organisation's internet-facing assets from the outside, from an attacker's point of view. Asset inventories are often incomplete: a server spun up for a project and forgotten, an IP block inherited after a merger, a cloud service left public for testing, or an expired certificate. Attackers scan the internet constantly; whoever finds these assets first has the advantage.

How Does It Work?

Continuous internet scanning: According to Palo Alto, Xpanse scans the entire IPv4 address space several times a day, finding not only known assets but also services the organisation is unaware of.

Attributing assets to the organisation: Discovered IP addresses, domains, certificates and cloud services are attributed to the organisation and linked to their owners, so the question "whose server is this?" does not go unanswered.

Prioritising risk: Exposures such as open remote desktop services, misconfigured systems, insecure protocols and expired certificates are presented together with their severity and reachability.

Expander and Active Response

Expander is Xpanse's web application and API that discovers, monitors and tracks the organisation's global internet attack surface, flagging new, known and unknown assets. The add-on Active Response module automates investigation, notification and remediation with out-of-the-box playbooks that run whenever a new attack surface alert is created; AI-powered playbooks automatically identify service owners and help close the exposure. Xpanse works alongside the other components of the Cortex platform, bringing external attack surface data into security operations.

Benefits for Organisations

Shadow IT assets missing from the inventory and forgotten internet services become visible, so action can be taken before attackers find them. Presenting risks with ownership information ensures remediation reaches the right team. New exposures created by acquisitions, mergers, cloud changes or temporary projects are detected quickly, and the external attack surface shrinks measurably.

To see your organisation's internet-facing attack surface and evaluate Cortex Xpanse, get in touch with ATEON's specialists.