External attack surface monitoring
Know the moment your attack surface changes.
Bastion checks the outside of the systems you already run — certificates, security headers, DNS, and what is listening — then keeps checking, and tells you when something moves. New subdomains, expiring certificates, ports that opened overnight. No agent to install, no code to change.
No card required to start. Plans from $25/month; cancel any time.
One score to watch, a report you can hand to anyone
The dashboard shows your posture and what moved since last scan. Every scan can also be exported as a branded PDF — ready for a client, a boss, or an auditor without editing a thing.
What gets checked
HTTP security headers
HSTS, CSP and frame-ancestors, X-Content-Type-Options, Referrer-Policy, permissive CORS, cookie flags, and whether http quietly serves content instead of redirecting.
TLS and certificates
Chain validity and trust, how close expiry is, negotiated protocol, whether TLS 1.0/1.1 still answer, key strength, and hostname/SAN coverage.
DNS and subdomains
SPF and DMARC policy strength, CAA, and subdomain discovery from certificate transparency logs — including dangling CNAMEs pointing at services someone else could claim.
Fingerprint and exposed services
What your stack tells the world about itself, plus a TCP connect check of common ports to flag anything answering that should not be.
Findings are scored from critical down to informational and rolled up into a single 0–100 posture number, so you can tell at a glance whether last week's change made things better or worse.
And then it keeps watching
A one-off scan tells you what is wrong today. Infrastructure drifts — so Bastion re-checks on a schedule and tells you what moved, which is the part you cannot get by running a tool once.
New subdomains nobody told you about
Preview deployments, contractor microsites and forgotten staging boxes appear in certificate transparency logs the moment they get a cert. You find out that week, not during an incident.
Certificates before they expire
Renewal warnings at 30, 14, 7 and 3 days, plus an alert if a certificate is ever issued for your domain by a CA you do not use.
DNS that changed when it shouldn't have
An unexpected NS or MX change is what account takeover looks like from the outside. An SPF record that quietly got broader is how spoofing starts.
Services that appeared overnight
A database port answering the internet is worth knowing about today, not next quarter.
Domains that look like yours
Typosquats and homoglyph registrations are the raw material for phishing and invoice fraud. Watched with public DNS and CT data only.
Your own registration lapsing
A domain that expires is worse than any misconfiguration. We track the registry record and warn you well ahead.
Critical changes are sent the moment they are found; everything else is batched into one weekly digest. Findings you have already dealt with can be muted or accepted with a review date, so the digest stays short enough to keep reading.
+ v=spf1 include:_spf.google.com -all
How it works
Add your domain
Takes about a minute — no agent to install, no code to change.
Bastion scans it
The first scan finishes in about a minute, then re-runs on a schedule so you hear about changes, not snapshots.
Get findings you can act on
Every finding has a severity, the evidence behind it, and the specific change that fixes it.
Hand the fixes to your coding agent
Most findings are small config changes that live in a repository — exactly what coding agents are built for. One click turns any scan into a hand-off pair: the PDF report plus a paste-ready prompt listing every open finding with its evidence, the suggested fix, and the verification step the agent must state before calling it done. Works with Claude Code, Codex, opencode or whatever agent you run.
Severity-ordered, evidence inline
The prompt lists findings worst-first with the scanner's evidence, so the agent spends its effort where it matters — and findings you've muted or accepted are left out.
Honest about what's not in the repo
Fixes that live at the registrar or in a hosting console come back as a flagged checklist with the exact change to make, instead of a hallucinated file edit.
Verified from the outside
Every finding carries a verification command. You review the diff, deploy, run the checks — and the next scan confirms the score moved.
The full hand-off prompt is included with every paid plan; the free trial shows a one-finding preview. How the workflow plays out in Claude Code, Codex and opencode is covered in the hand-off guide.
Evidence for your next audit
SOC 2 and ISO 27001 auditors don't just ask whether you monitor your external infrastructure — they ask you to prove it operated all year. Bastion produces that proof as a side effect of running: scheduled scans with full history, an alert trail, and dated PDF reports you can hand over as-is.
SOC 2
The Common Criteria expect you to monitor infrastructure for vulnerabilities and configuration change (CC7.1) and to evaluate that monitoring (CC4.1). A year of scheduled scans, alerts, and resolved findings is that control operating — across the whole audit period, not just the week before fieldwork.
ISO 27001
Annex A 8.8 asks how you manage technical vulnerabilities and A.5.7 asks where your threat intelligence comes from. Scan history plus CT-log subdomain discovery and lookalike-domain watching answer both with dated records instead of a described process.
Security questionnaires
“Do you perform external vulnerability scanning?” appears on nearly every vendor review. Attach last week's PDF — scope, findings, severities and date on the first page — instead of writing a paragraph an assessor has to take on faith.
Point-in-time proof
Every scan is kept, and any of them exports as a branded, dated PDF. When an auditor asks what your posture was in March, you send March's report rather than reconstructing it.
Honest scoping: Bastion is monitoring evidence for a handful of controls, not a compliance program. It does not replace a penetration test, and it is not a PCI ASV scan. It covers the "continuous external monitoring" row of your controls matrix — and covers it well. Full control-by-control mapping in the audit evidence guide.
Frequently asked questions
What is external attack surface monitoring?
External attack surface monitoring (also called EASM) is the practice of continuously checking what your organization exposes to the public internet — domains, subdomains, TLS certificates, DNS records, HTTP security headers and open ports — and alerting you when something changes. Unlike a vulnerability scanner, it looks at your infrastructure the way an outside attacker would: from the internet, with no credentials and no agent installed.
Does Bastion require installing an agent or changing code?
No. Bastion is entirely external and passive. You add a domain and Bastion observes only what is already visible from the public internet: HTTP response headers, the TLS handshake, public DNS, certificate transparency logs, and whether common ports accept a connection.
Is scanning with Bastion safe for production systems?
Yes. Every check is passive: Bastion reads headers, completes a normal TLS handshake and queries public DNS — the same traffic any browser or mail server generates. There is no fuzzing, no exploitation, no authentication attempts and no load testing, so it cannot disrupt a production system.
Can I scan any domain with Bastion?
No — only domains you control. Each domain passes a quick ownership check before any scan runs. Bastion is deliberately built so it cannot be pointed at someone else's infrastructure.
How is Bastion different from a one-off scanner like SSL Labs or Security Headers?
Free graders like Qualys SSL Labs or securityheaders.com give you an excellent snapshot of one thing at one moment. Bastion runs those categories of checks together — TLS, headers, DNS, email authentication, exposed services and subdomain discovery — on a schedule, keeps history, and alerts you when something changes. The change detection is the part a one-off scan cannot give you.
Can Bastion reports be used as evidence for SOC 2 or ISO 27001?
Yes — as evidence that you continuously monitor your external attack surface, which is what SOC 2 CC7.1 and ISO 27001 Annex A 8.8 ask for. Bastion keeps every scheduled scan and alert, and any scan exports as a dated PDF, so you can show the control operating across the whole audit period. It complements rather than replaces a penetration test, and it is not a PCI ASV scan.
Can a coding agent like Claude Code fix Bastion's findings?
Yes — most external findings are small config changes that live in a repository, which is exactly what coding agents handle well. Every completed scan has a one-click hand-off that downloads the PDF report and generates a paste-ready prompt for Claude Code, Codex, opencode or any other agent: findings sorted by severity with evidence and suggested fixes, plus a verification step per finding. Fixes that live outside the repo — registrar DNS, a hosting console — come back as a flagged checklist for a human.
How much does Bastion cost?
Plans start at $25/month, with two months free on annual billing. Every plan starts with a 7-day free trial and no card is required to begin. See the pricing page for what each plan includes.
Latest from the blog
Comparisons, how-tos and plain-language explainers on what the outside world can see about your infrastructure.
The Gap in Your Compliance Stack Is the Part the Internet Can See
Compliance tooling monitors the assets you enrolled: laptops in MDM, cloud accounts in CSPM, repos in CI. Breaches keep coming from assets nobody enrolled. Why every control in the stack is inside-out, and where an external scanner fits.
Read article →Bastion vs. OpenVAS: Vulnerability Scanner or External Monitor?
OpenVAS is a free, self-hosted vulnerability scanner with tens of thousands of CVE checks; Bastion is a hosted external monitor that watches your domains for drift. What each actually does, the operational cost of self-hosting, and when to run both.
Read article →Hand Your Security Findings to a Coding Agent: Claude Code, Codex and opencode
Most external scan findings are config changes living in a repo — exactly what coding agents are good at. How to hand a scan report to Claude Code, OpenAI Codex or opencode so the findings actually get fixed, and what to keep a human on.
Read article →Turning External Monitoring Into SOC 2 and ISO 27001 Evidence
SOC 2 CC7.1 and ISO 27001 Annex A 8.8 both expect continuous monitoring you can prove. How to use external attack surface monitoring as audit evidence — what maps to which control, what auditors sample, and what it does not cover.
Read article →The Best External Attack Surface Monitoring Tools in 2026, Compared
A practical comparison of external attack surface monitoring options in 2026 — Bastion, Detectify, Intruder, Shodan Monitor, Censys, Microsoft Defender EASM and free tooling — organized by team size and budget.
Read article →Bastion vs. Detectify: Which External Security Monitor Fits Your Team?
An honest comparison of Bastion and Detectify for external attack surface monitoring: what each checks, how they price, and which team each one actually fits.
Read article →Find out what is exposed.
Add your domain and have your first report in a couple of minutes.
Start your 7-day trial