Attackers map your perimeter. So should you.

Since 2017 we have run Vulmon, a vulnerability intelligence search engine used by security practitioners to research CVEs, and Vulmon Alerts, a free service that tells people when a vulnerability affects software they care about.

That work taught us where vulnerability management actually breaks. It is rarely the CVE research. Teams know how to research a CVE. What they don't know is which of their own systems are exposed to it, because nobody has a current, honest list of what the organization runs on the public internet. The inventory is the hard part, and it is the part that goes out of date fastest.

Vulmon Recon is our answer to that gap: keep the inventory current automatically, then apply the vulnerability intelligence to it.

Give it a domain, an IP range, or a read-only cloud account. From there it maps subdomains, IP addresses, open ports, live websites, TLS certificates and the technologies behind them. Then it matches what it finds against known CVEs, misconfigurations and certificate problems, and keeps watching as things change.

Everything works from the outside, the way an attacker sees you. There are no agents to install and no code changes. We run non-intrusive reconnaissance — mapping and fingerprinting, never exploitation — and only against assets you have put in scope.

Every plan ships the full product. Users and teams are unlimited, there are no support tiers, and no capability is held back for a higher tier. Plans differ by one number: how many assets you keep in scope.

We chose that deliberately. Tiering features punishes the teams least able to absorb it — the small ones, who end up paying for a product deliberately made worse. Sizing by capacity is the one dimension that reflects genuine cost.