Before
Security engineers manually queried the external asset inventory, reviewed newly exposed assets, and copied technical and bug bounty scope information between disconnected tools. They also updated governance records, decided whether assets qualified for auto-approval, and applied tags or notifications individually, allowing new assets to remain unreviewed for days.
How it works
- Discover and enrich external assets on a daily schedule, using accessible page content and conservative AI analysis to identify technical context.
- Check each asset against the governance register and active bug bounty scopes, then create or update the corresponding record with detection, enrichment, and scope information.
- Apply strict AI approval criteria, tag qualifying assets, and notify Infosec while leaving uncertain cases for manual review.
Workflow details
- Scheduled discovery: Each day, the workflow retrieves external assets from the monitored attack surface project and processes them individually, ensuring newly detected exposures enter the governance process without waiting for an analyst to find them.
- Asset enrichment: For every asset, the workflow attempts to retrieve publicly accessible page content and uses AI to identify technical characteristics such as surface type, brand, environment, application context, and confidence notes. The enrichment is deliberately conservative: uncertain fields remain blank rather than being guessed.
- Governance registration: The workflow checks whether each asset already exists in the asset governance register. It creates a new active record for previously unknown assets or updates existing records with detection metadata and enriched context.
- Bug bounty validation: The asset is compared with active bug bounty program scopes, and the corresponding governance record is updated to reflect whether the asset is included in scope.
- Approval and handoff: An AI decision step evaluates production status, exposure type, hostname patterns, brand identification, administrative signals, non-production indicators, sensitive technologies, and standard-port requirements. High-confidence qualifying exposures are marked for security assessment, tagged, and communicated to Infosec, while ambiguous or non-qualifying assets remain available for manual review.
What changed
External assets are now discovered and processed on a scheduled basis, with registration, enrichment, bug bounty comparison, and governance tagging performed automatically. Human attention is reserved for incomplete or ambiguous cases, while qualifying exposures are routed to Infosec with an AI-generated approval recommendation and supporting context.
Work removed
Manually querying the external asset inventory, reviewing assets one by one, fetching and interpreting public page details, cross-referencing bug bounty scopes, checking whether records already exist, copying data into the governance register, applying asset tags, and sending review notifications.
Expected outcome
An estimated 8–15 recurring manual actions are removed per asset cycle, with more consistent governance coverage across the monitored external attack surface.
