Key takeaways

• Agentless by design: a single probe covers multiple subnets, with no software deployed to your endpoints. Deployment is measured in minutes, not weeks.
• A fixed seven-stage pipeline runs the same way every time, under a strict thirty-minute ceiling, so results are repeatable and a scan never hangs.
• Results are uploaded only at the end of a scan as one consistent record — never a partial state to reconcile.
• The probe is driven entirely from the server through a thirty-second heartbeat. There is no inbound SSH and no shell access into your network.
• One agentless probe delivers what competitors sell as several separate products: resolved asset inventory, vulnerabilities, network topology, drift, directory evidence and compliance — correlated and billed per real device.

Putting an agent on every endpoint does not scale: it means software to deploy, update and troubleshoot on thousands of machines. Scout takes the opposite approach. It is one lightweight probe placed on a single host inside the network, and it observes the network to deduce what is present — no footprint on the endpoints themselves.

Onboarding is a single copy-and-paste command. The goal is that anyone can bring a probe online in minutes, with no packages to compile and no manual configuration. From that point the probe is driven entirely from the server.

Onboarding runs as a short, fixed sequence: local install steps on the host, two authenticated calls out to RECON, and a first discovery pass that seeds the inventory. A reinstall reuses the existing credential and skips key rotation.

Before anything else, the probe has to discover what is alive on the network. No single method sees everything, so it combines many active and passive techniques and starts with a reachability check, so a dead subnet never sends the whole scan to a halt.

Once a device is found, the probe works out what it is — operating system, vendor, model, device type and the services it runs. The more signals it can cross-reference, the more reliable the answer, and this resolved identity feeds both the inventory and the correlation of vulnerabilities.

Discovery and fingerprinting resolve into a single inventory: device categories, counts and a live feed of what the probe finds as it works.

Every scan runs the same spine of seven stages under a strict thirty-minute ceiling. Passive side-channels listen alongside the first stage and feed discovery, and only the final consolidated record is uploaded — never a partial state.

Every scan runs the same seven stages in the same order, under a thirty-minute ceiling. The fixed order makes results repeatable, and the results are uploaded only at the end — as a single, consistent record rather than a stream of partial updates.

While a scan runs, RECON reports progress live — each stage lighting up as the probe advances and results accumulating alongside.

Security checks run only against the ports that are actually open, so the cost on the wire stays low and the network stays quiet. The catalogue grows in waves — a base set, then industrial protocols, then cloud-native services — so coverage extends without re-engineering the core.

Frameworks & protocols covered

Every thirty seconds the probe checks in, and the heartbeat response tells it what to do next. Each spoke is an independent state machine — scan dispatch, configuration reload, self-update, remote uninstall, discovery refresh and stale-scan recovery — so RECON pilots the fleet without ever opening an inbound connection.

Beyond individual machines, the probe reconstructs how the network is wired, what has changed since last time, where the probe physically sits, and whether any of what it sees is deliberately fake. These are the layers that turn a list of hosts into a picture of risk.

Every endpoint has its own authentication, chosen by who is calling. The probe’s own data travels with its credential; administrative actions require an authenticated user session. The two layers never blur into one another, and the probe is never reachable from outside your network.

One unified attack surface

Internal scan data does not live in isolation. RECON brings internal, external and Active Directory findings together in one console, so a device seen inside the perimeter can be viewed alongside its external exposure and identity posture — rather than living in three separate tools — and it is billed per real device on a rolling inventory, not per raw IP address.

A single agentless probe does the work that competitors sell as several separate products. RECON collapses three categories — vulnerability management, asset discovery and directory security posture — into one probe with a unified interface and a single per-device bill.

Next steps

• Request a scoping call to map your internal networks and size a probe deployment.
• Get a sample internal scan report to see resolved inventory, topology and compliance mapping side by side.
• Deploy a probe in minutes with a single command and see your internal attack surface in your browser.