01
Domains & DNS
Newly registered subdomains, dangling CNAMEs to SaaS tenants you cancelled, expired records still resolving, hijackable registrar logins.
1,204
subdomains watched
Live, agent-driven
for teams without a SOCYour attack surface is
bigger than you think.
We watch the rest
while you sleep.
Forewatch runs a 24/7 AI monitoring agent across every domain, subdomain, exposed cloud bucket, stale DNS record, dangling SaaS integration, and harvested credential your company touches. Every morning at 7am you get one plain-English brief: what changed overnight, what is most likely to be weaponised, and what to do about it with the smallest reasonable step.
Your attack surface is every server, subdomain, cloud bucket, login page, vendor integration, and leaked credential a bad actor could find online.
$430/movs enterprise $90k+/yr55%of SMBs still lack adequate EASM27% CAGRattack-surface market
morning brief07:00 · your TZ
acme.co · last 18h
3 things changed overnight. 1 is likely weaponisable.
critical · bucket.acme.co became public 03:14 UTCWorld-listable after a Terraform drift. Likely weaponisable today.→ One-line bucket-policy rollback. Diff attached.
high · ops@acme.co #leak hit in fresh stealer batchActive SSO session still live. Default first step is session kill + reset.→ Forewatch opens a Jira ticket automatically.
medium · 2 wildcard certs still valid on dead zonesRevoke via your CA console; deep-link inside the ticket.→ Estimated time to fix: 6 minutes.
overall coverage score 82 / 100 · +3 overnightv3.4 · agent scan #1,204
Three things, every morning
What you actually get on day one.
No dashboards to learn. No vendor acronym soup. Three daily jobs your founder can read in five minutes, before the rest of the team wakes up.
01
Continuous monitoring
Forewatch polls your domains, subdomains, DNS, cloud buckets, and SaaS footprint every day, so a new subdomain that points at an exposed service is in your brief before it lands in a scan of the rest of the internet.
02
Exposed cloud-bucket detection
S3, R2, GCS, and Azure blobs that quietly became world-listable — checked, ranked, and rolled back with the smallest reasonable fix attached to each ticket.
03
Plain-English daily brief
Every morning at 7am, one short document. What changed overnight, what is most likely to be weaponised, and the one step back to green. No scanner acronyms in the visible copy.
One brief. Every morning.What your founder reads
What your founder reads
at 7am, before coffee.
No dashboards to log into, no jargon to triage, no Slack thread your security contractor starts at 11pm. The brief is a short, opinionated document: three things changed overnight, ranked, each with the smallest reasonable step back to green. Below is the actual layout — switch categories to see how the same shape covers different parts of your attack surface.
Newly registered, expired, dangling, hijackable
Sample records · real engagements anonymisedfwd-relay.io
CNAME pointed to a marketing SaaS you cancelled 9 months ago
Weaponisable — Attacker re-registers the SaaS tenant and rides your brand.
criticalReview DNS today — 11 records stale beyond grace period.
login.acme.co
Newly added subdomain exposing a marketing preview tool
Weaponisable — OAuth abuse against newsletter subscribers via misconfigured preview app.
highConfirm with marketing in 1 Slack DM or we add it to the WAF denylist.
*.acme.co
2 wildcard certs still valid on zones without live traffic
Weaponisable — Mis-issuance by a CA — your users trust them for a year.
mediumRevoke via your CA console; link in the ticket.
What we watch, in your name
Four fronts. One scanning agent. No analyst required.
The external attack surface market is projected to grow from $1.32B in 2024 to $6.87B by 2030. The reason — every company is now a SaaS-and-cloud-and-API-sprawl company, and the stale-pivot / dangling-CNAME / forgotten-OAuth-app plays keep landing on the front page. Forewatch compresses the asset discovery, leak harvesting, dedupe, and triage playbooks enterprise EASM vendors charge six figures for into one background service.
02
Cloud buckets & blobs
Public S3, R2, GCS, Azure blobs that became world-listable after a Terraform drift; SAS-token leakage; old prod buckets still serving files.
37
buckets audited
03
Leaked credentials
Pastebins, stealer logs, GitHub history, employee pivots — surfaced and rotated, with SSO session revocation as the default first step.
412
leak sources polled
04
SaaS integrations
Zapier and Make webhooks nobody owns, retired OAuth apps still refreshing, "Anyone with the link can edit" docs leaking runbooks.
89
integrations mapped
How it works
Discovery → dedupe → brief
- 01Discovery
The agent lands the perimeter.
Forewatch seeds an AI-driven enumerator across your domains, ASNs, login flows, and known SaaS footprint. It runs in the same way an attacker would: subdomain brute-force, CT-log watching, GitHub-code search, bucket-list scripts.
- Continuous CT-log + WHOIS surveillance for new and expired assets
- Multi-tenant enumeration via subdomain + Asnipster + Shodan-equivalent pivots
- GitHub + pastebin + stealer-log leak harvesting on every employee handle
- 02Dedupe
Noise → signal, in-platform.
A billion raw signals means nothing. Forewatch folds every new event into a known-asset graph, deduplicates against the last 30 days, and tags anything genuinely novel so the brief only contains things that actually changed.
- Asset graph maintained per tenant; identical filters do not re-trip a ticket
- False-positive layer tuned per-vertical — subdomain enumeration against a CDN is not an alert
- Severity raised only when change-risk crosses your price-of-the-fix budget
- 03Brief
7am, in your inbox.
The morning brief is two pages, opinionated, ranked, each finding carrying the smallest reasonable remediation step. Tickets route into Jira, Linear, GitHub Issues, or plain email — whichever your team actually opens.
- Plain-English rationale per finding, no scanner-vendor acronyms in the visible copy
- One-click open-a-ticket in the destination track of your choice
- Weekly trend digest + monthly coverage score for your leadership read-out
Why nowBuilt for the 55% of businesses
Built for the 55% of businesses
the enterprise tier forgot.
Gauntlet-tier EASM — Bitsight, CyCognito, Outpost24, ProjectDiscovery — assumes you have a SOC analyst on staff to wire, tune, and triage the platform. We reverse the assumption: a 10-person team should be able to log in on Tuesday, point Forewatch at their domains, and read their first brief on Wednesday.
Sources: ESG 2025 attack-surface survey · IDC EASM 2024–2030 forecast · internal customer pilots.
- Now
- $1.32B
- 2024 EASM market
- Then
- $6.87B
- 2030 projection
- Under-served
- 55%
- of SMBs lack EASM (2025)
Pricing, in plain EnglishOne transparent subscription.
One transparent subscription.
No SOC seat. No six-figure floor.
Pick the tier that covers your domain count. Every tier includes the morning brief, dupe-dedupe, and ticket routing into Jira, Linear, GitHub Issues, or plain email. Need deeper coverage or vendor risk scoring? Email us.
Lean
Solo founder or small SaaS, ≤ 6 monitored domains.
$99/month, billed annual
- Daily plain-English morning brief
- Email ticket routing
- CT-log + subdomain watch
- 1 user seat
Company
Most teams
10–50-person teams wanting bucket, credential, and SaaS coverage too.
$430/month, billed annual
- All Lean coverage
- Bucket + SaaS + credential harvesting
- Jira / Linear / GitHub Issues routing
- Weekly digest + monthly score
- 5 user seats
Scale
100+ employee orgs with multiple domains, brands, and subsidiaries.
$1,490/month, billed annual
- All Company coverage
- Per-brand brief segmentation
- Custom remediation playbooks
- SAML SSO + audit log
- Unlimited user seats
Every tier includes daily plain-English brief and ticket routing. Pricing below enterprise EASM list price — no surprise renewal, no per-asset add-on, no SOC-analyst seat in the math.
FAQ
The questions founders and security-curious operators ask first.
If your question is not here, write to forewatch-7@polsia.app.
Is Forewatch an MSSP or an EASM platform?
Neither in the traditional sense. An MSSP needs a SOC analyst; an EASM platform needs one to operate it well. Forewatch runs the discovery, dedupe, and brief-generation logic on its own, so a 10-person team can use it without hiring security headcount. If you already have a SOC, Forewatch complements them by removing the boring first-lap enumeration work.
What does the morning brief actually look like?
A short, opinionated document. Every changed item gets ranked (critical / high / medium / low), each finding has a one-paragraph weaponisation explanation, and each carries a single smallest reasonable step back to green. Tickets route into Jira, Linear, GitHub Issues, or plain email — whichever your team actually opens. See a sample layout in the brief section above.
How fresh is the data?
Enumeration runs continuously. CT-log watching is near-real-time. Stealer-log harvesting polls every 6 hours. The brief at 7am covers the prior 18-hour window.
Does Forewatch run active tests against our assets?
Passive by default — Forewatch observes what is already publicly exposed and what an attacker would see. We do not run brute-force login attempts, exploit chains, or denial-of-service tests. A scoped active-mode is available on Scale if you want us to probe specific surfaces, run with full authorisation and audit log.
Will you spam our security team?
The brief is one document per morning — that is it. If you turn on Slack alerts, you control the channel and threshold. We do not push marketing email and we do not have a sales-development team working the trial. The product is the conversation.
How does this compare with Bitsight, CyCognito, Outpost24, ProjectDiscovery?
They each cover parts of this surface well, at enterprise price points and with an operating model that assumes you have a SOC analyst on staff. Forewatch is opinionated about the SMB/launching-team shape — same discovery, same dedupe, same brief-shaped output, no analyst in the math.
Next stepPoint us at your domains.
Point us at your domains.
Read the brief tomorrow.
We start every engagement with a 20-minute call, then run a free three-week pilot across the assets you already have. No setup fee, no contract, no SOC analyst in the loop.