Monitor what your business exposes to the internet.
Scheduled Assay scans of your internet-facing systems, with the changes that require action identified by Black Shard engineers, delivered Australia-wide.
Attack surfaces change between penetration tests. Assay monitors external systems for new hosts, exposed services, vulnerable software, TLS issues and other changes that alter your external security position. For managed engagements, Black Shard reviews the results and identifies the changes that require action rather than sending an unfiltered scanner report.
Black Shard is an Australian software engineering and cybersecurity firm headquartered in Brisbane. Assay is our scanner, built and operated by the firm, and the managed service is delivered Australia-wide.
What the monitoring covers
Assay scans your internet-facing footprint on a standing schedule: every exposed host and service catalogued, remote-access and database ports flagged when they surface, and findings checked against known CVEs, misconfigurations, default logins and TLS problems. Findings are ranked against CISA's Known Exploited Vulnerabilities catalogue and EPSS exploit probabilities. Email authentication is checked over DNS as well: SPF and DMARC, including softfail and p=none policies that leave a domain open to spoofing.
Each scan is diffed against the last one, so the report is a change list. Where a gap matters, the route an attacker could take to reach it is expressed in MITRE ATT&CK terms. Every finding carries one of four verdicts: OK, at risk, not assessed because a scan could not complete, or not observable from outside. Only the first is treated as a pass.
- Scheduled scans of your external footprint on a standing cadence
- Findings ranked against CISA KEV and EPSS exploitation data
- Change tracking that diffs each scan against the last
- A written monthly position: what changed, what matters, what to fix first
- Evidence for an insurer or a customer's security questionnaire
- Remediation by Black Shard where a finding needs closing
Monitoring compared with a point-in-time scan
A point-in-time report describes the attack surface on the day it ran. A subdomain stood up for a campaign, a database port opened for a one-off job and never closed, a certificate that lapsed on a system nobody remembers building: none of it appears in a report from months earlier.
Monitoring compares every scan with the last one, so what lands in your inbox is the change since the previous period and what it means.
Assay and the managed review
Assay marks a finding OK only once the scan has verified it. Where a scan cannot see a system or cannot complete against it, the verdict says so and is never treated as a pass.
For a managed engagement, Black Shard engineers read each period's results against what the business runs, identify the changes that require action, and write the position. The engineers who read the scans also run the firm's penetration tests, Azure and Entra ID reviews and remediation work, so where a finding needs closing the fix can be scoped by the same firm. Black Shard holds SMB1001:2026 Gold, verifiable on CyberCert's registry, and self-assesses against the ASD Essential Eight at Maturity Level 2.
Delivered Australia-wide
The engagement runs the same way wherever the business is based. Scoping, the periodic review and any follow-up conversation happen by email and video call, and the position carries the same review either way.
Brisbane businesses that would rather sit across a table for the review have that option.
What does attack-surface monitoring cost?
No figure is published. Cost follows what is in scope: the number of domains and hosts in the footprint, how many environments are run, and whether the engagement stops at reporting or extends to remediation.
Send a brief to info@blackshard.com.au with a rough shape of what you want watched, and the reply comes back with the questions needed to scope it.
Questions, answered
- How is this different from a penetration test?
- A penetration test establishes what an attacker can do with your systems in a defined, bounded engagement. Monitoring is the standing watch between tests: scheduled scans that catch drift and known exploitable weaknesses as they appear. Many businesses run both.
- How often do the scans run?
- On a schedule agreed at scoping, with change tracking that compares every scan against the one before it. The cadence depends on how much of the footprint changes and how quickly you need to know.
- Will you contact us before the monthly report if something urgent comes up?
- Yes. The monthly written position is the standing rhythm. A finding that cannot wait is raised when it is found.
- Can you fix what the scans find?
- Yes. Where a finding needs closing, Black Shard can engineer the fix. Monitoring, penetration testing and remediation engineering run from the same firm.
- What does a 'not observable' or 'not assessed' verdict mean?
- The scan could not see the system from outside, or could not complete against it. Neither is treated as a pass. The verdict records the gap in coverage instead of assuming the system is fine.
- Do you deliver this outside Brisbane?
- Yes. Black Shard is an Australian firm headquartered in Brisbane and delivers Australia-wide; the monitoring runs the same way regardless of where the business is based. Brisbane businesses can choose an in-person review.
Related reading
The full practice: Security advisory & vCISO.
Tell us what you need built, reviewed or secured.
Brisbane head office. Work delivered across Australia.