KnowWhat'sActuallyExposed

REGISTER A TARGET, RUN A SCAN, GET REAL FINDINGS CORRELATED AGAINST KNOWN CVEs. WITH EVIDENCE AND CVSS, NOT A RISK SCORE GUESS.

scoped to targets you register · no credentials required to start

Barn owl in night-vision green, symbolizing continuous vigilance

DISCOVERS SERVICES LIKE:

AWS
Cloudflare
Kubernetes
Datadog

Most breaches aren't sophisticated.They're just unseen.

Before you run a scan

Questions engineers actually ask.

Yes, by design. Samaritan performs active reconnaissance and service checks against targets you explicitly register: the same category of traffic a port scanner or vulnerability scanner generates. It never touches infrastructure you haven't added as a Target, and every scan is logged. Think of it as a scheduled, repeatable nmap-class scan, not a passive observer.

The scan engine.

How a scan works: from target registration to CVE-correlated findings.

Target Discovery

Port and service enumeration on registered targets.

Real TCP and service probes against the host or domain you register: the same checks a manual nmap run would produce, scheduled and repeatable on demand.

CVE Correlation

Findings matched to known vulnerabilities.

Every discovered service is checked against CVE databases and scored by CVSS, with evidence attached to each match.

Finding Triage

Severity-ranked results.

Every finding is scored by CVSS and severity so you know what to fix first: not a flat list of ports with no context.

Target Tracking

Every registered target, one place.

Hosts, domains, and port ranges you've added as Targets, with full scan history per target.

Reporting

Exportable scan reports.

Every scan produces a structured report with CVSS scores, severity, and evidence per finding: ready to export or share.

samaritan-scan-engine / tty1
14:02:01.442[INFO]Target registered: acme-corp.io - scan queued [SCAN-4821]
14:02:01.890[INFO]DNS enumeration: 18 subdomains discovered via zone walk + CT log analysis
14:02:02.105[INFO]Port scan complete: 9 IPs, 12 exposed services mapped
14:02:02.150[WARN]Service fingerprint: dev.acme-corp.io:9229 - Node.js V8 inspector, unauthenticated
14:02:02.320[WARN]Service fingerprint: metrics.acme-corp.io:9090 - Prometheus, no auth required
14:02:02.500[INFO]CVE lookup: nginx 1.24.0 on :443 - 2 matching CVEs found, max CVSS 7.5
14:02:02.812[CRIT]ScanResult written: F-001 - Node.js inspector RCE surface, CVSS 9.8, confidence 0.99
14:02:03.000[SYS]Awaiting next scan
CVSSScoring on every findingeach ScanResult is scored and severity-ranked, no flat port lists
ActiveReconnaissance by designreal TCP and service probes, the same checks a manual nmap run produces
ZeroCredentials required to startregister a target, run a scan: no agent, no IAM role, no handoff

What a scan produces

› DNS enumeration: subdomains, IPs, TLS certs
› Service fingerprinting: ports, versions, auth state
› CVE correlation: CVSS score and evidence per finding
› Severity-ranked ScanResult per target

Stop guessing.
Start seeing.

Initiate Scan

scoped to targets you register · no credentials required to start