Know what changed across the infrastructure you manage.
SurfaceDiff helps hosting providers, MSPs and managed cloud teams detect changes across public-facing domains, hosts, ports, services, DNS and TLS - with timestamped evidence and host-level correlation.
14 days. Up to 20 verified domains. No card. No automatic subscription.
Infrastructure changes. Public exposure changes with it.
A temporary port opened for testing can remain exposed after the work is complete.
A staging subdomain can become publicly reachable.
A DNS update can redirect traffic unexpectedly.
A service running on an existing port can change without anyone noticing.
SurfaceDiff creates recurring external snapshots and shows what changed between them.
New public port
A port opened for a deployment or a test can remain reachable long after the work is done.
New or changed subdomain
A staging or development subdomain can become publicly reachable without anyone deciding it should be.
DNS change
A DNS update can redirect traffic to different infrastructure than the team expects.
Service fingerprint change
A service running on an already-open port can change without triggering any alert on its own.
Built for teams managing many domains and shared infrastructure.
See the change, not only the current state
Traditional scanners show what is exposed now. SurfaceDiff shows what appeared, disappeared or changed since the previous scan.
Reduce repetitive investigation
Correlate domains with shared infrastructure so one host-level change does not create dozens of repeated investigations.
Keep timestamped evidence
Each incident includes the previous state, current state, timestamps and supporting evidence.
Start without installing agents
SurfaceDiff observes verified domains externally, without requiring software installation across customer servers.
Where SurfaceDiff fits
Managed hosting providers
Monitor changes across customer domains after provisioning, migrations, maintenance and configuration work.
MSPs and MSSPs
Add recurring external change monitoring to managed security and infrastructure services.
Managed WordPress and agency platforms
Detect unexpected exposure across production, staging and development environments.
Cloud and data centre operators
Maintain an independent external view of changes across managed customer infrastructure.
Guided 14-Day External Exposure Assessment
Validate SurfaceDiff on a representative part of your real environment before deciding whether continued monitoring makes sense.
- Guided selection of up to 20 verified domains
- Shared-infrastructure mapping
- Initial external exposure baseline
- 14 days of recurring monitoring
- Detection of changes across ports, services, subdomains, DNS and TLS
- Review of detected incidents
- Final findings summary
- No card
- No automatic subscription
At the end of the assessment, your team receives a clear record of what was exposed initially, what changed during the monitoring period and which findings require further review.
How the assessment works
Select representative domains
We help choose up to 20 domains that reflect your hosting or managed infrastructure environment.
Verify ownership
Domains are verified before scanning to ensure SurfaceDiff only monitors authorized infrastructure.
Establish the baseline
SurfaceDiff records the initial public exposure across hosts, ports, services, DNS, subdomains and TLS.
Monitor changes
Recurring scans compare each new snapshot with the previous state.
Review the findings
We review detected changes with your team and provide a final summary.
Designed for controlled and authorized monitoring
- Only verified domains are monitored
- No agent installation is required
- Access is role-based
- Incidents retain evidence and activity history
- Monitoring is limited to authorized external infrastructure
- SurfaceDiff does not attempt to exploit detected services
- Application data is hosted on infrastructure located in the European Union
- All traffic to and from SurfaceDiff is encrypted with TLS
What SurfaceDiff is not
SurfaceDiff is not a vulnerability scanner, firewall or traffic-blocking system.
It does not replace internal monitoring, SIEM or endpoint security.
It provides an independent external record of what changed across the public-facing infrastructure you manage.
Use SurfaceDiff as part of your managed service
MSPs, MSSPs and hosting providers can use SurfaceDiff to extend their existing monitoring and security services with recurring external exposure change detection.
Partner and multi-domain deployments can be discussed during the guided assessment.
Request a Guided Assessment
Every request is reviewed manually.
FAQ
Does SurfaceDiff scan unverified domains?
No. Domains must be verified before monitoring begins.
Does SurfaceDiff exploit detected services?
No. SurfaceDiff identifies externally visible changes and supporting service information. It does not attempt to exploit discovered services.
Is SurfaceDiff a vulnerability scanner?
No. SurfaceDiff focuses on changes in external exposure rather than CVE detection.
Can it monitor shared hosting environments?
Yes. SurfaceDiff can correlate domains with shared infrastructure to reduce repetitive host-level findings.
Is the assessment free?
The initial guided assessment is currently offered without payment details to selected hosting providers, MSPs and managed cloud teams.
What happens after 14 days?
We review the results with your team. You can then decide whether continued monitoring or a wider deployment makes sense.
Related
See what changes across the infrastructure you manage.
Validate SurfaceDiff on up to 20 verified domains through a guided 14-day external exposure assessment.
Request a Guided AssessmentNo card. No automatic subscription. Every request is reviewed manually.