Continuous exposure monitoring for MSSP client portfolios

Per-seat VM pricing breaks the MSSP margin

The endpoints that solve it

The canonical MSSP fan-out

# Weekly exposure sweep across every client domain
# CLIENTS.txt: one root domain per line

while IFS= read -r domain; do
  curl -s https://api.dfir-lab.ch/v1/exposure/scan \
    -H "Authorization: Bearer $DFIR_API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"target\": \"$domain\"}" \
    > "./reports/$(date +%Y-%m-%d)/$domain.json"
done < CLIENTS.txt

# Each response includes:
#   subdomains[], services[], tls_findings[], risk_score, severity_counts

# Optional: enrich any suspicious IPs that surfaced across the sweep
curl https://api.dfir-lab.ch/v1/enrichment/lookup \
  -H "Authorization: Bearer $DFIR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "indicators": [
      { "type": "ip",     "value": "203.0.113.42" },
      { "type": "domain", "value": "stale-dev.clientX.tld" }
    ]
  }'

1. 01
   Step 01

   Inventory

   Pull the client list from your PSA (Autotask, ConnectWise, HaloPSA) or a flat CSV. Each row needs a root domain and the internal client ID.

2. 02
   Step 02

   Schedule

   Run the fan-out on your cadence — weekly for most MSSPs, daily for high-value clients. Airflow / GitHub Actions / a plain cron are all fine; the API is stateless.

3. 03
   Step 03

   Scan

   POST each domain to /v1/exposure/scan. Responses come back as normalized JSON per client, keyed by your internal client ID.

4. 04
   Step 04

   Diff + enrich

   Diff this week's findings against last week's. New open ports, newly discovered subdomains, or newly suspicious IPs go through /v1/enrichment/lookup for reputation context.

5. 05
   Step 05

   Report

   Write structured findings into your client portal. Generate the monthly narrative with /v1/ai/threat-profile so the written brief matches the client's sector without analyst hand-curation.

Pricing that tracks your workload

1. 01

   Small MSSP — 20 clients × weekly scan

   20 × 4 × 10 credits = 800 credits/month (scans only)

   Fits Starter ($29, 500 credits) only with bi-weekly cadence; Professional ($99, 2,500 credits) fits weekly with ~1,700 credits left for enrichment and threat profiles.
2. 02

   Mid-size MSSP — 50 clients × weekly scan + enrichment

   (50 × 4 × 10) + (50 × 4 × 5 IOCs × 3) = 2,000 + 3,000 = 5,000 credits/month

   Exceeds Professional (2,500) — run Professional + a 5,000-credit top-up, or move to Enterprise for unlimited usage.
3. 03

   Large MSSP — 150 clients × weekly scan + monthly threat profile

   (150 × 4 × 10) + (150 × 1 × 20) = 6,000 + 3,000 = 9,000 credits/month

   Enterprise tier (custom pricing, unlimited credits) is the only sensible fit at this volume.

Three ways to evaluate

Frequently asked

Q / 01

How does this compare to Qualys / Tenable / Rapid7 for MSSP use?

Those are authenticated internal scanners with a per-asset license model. DFIR Platform's exposure endpoint is external-only (no agents, no credentials) and priced by credit, not per client. If you need authenticated internal scanning you still need a VM tool; if you need continuous external exposure monitoring across a large client book, this endpoint is built for that fan-out pattern.

Q / 02

Can I label findings with an internal client ID?

The request is stateless — you control how findings are labelled by keying the response against your internal client ID when you write to your reporting store. The API does not currently have a first-party multi-tenant client model; that mapping lives in your orchestrator.

Q / 03

How deep does the subdomain enumeration go?

The endpoint uses passive sources (CT logs, DNS aggregators) plus lightweight active probing. It will reliably surface the public subdomain inventory and open services reachable from the internet. It is not a substitute for active port-scanning tools like masscan if you need exhaustive port coverage.

Q / 04

Is there rate limiting when I fan out across hundreds of clients?

Paid tiers get a sensible default rate-limit bucket that covers hundreds of sequential scans over a few hours. If you want to parallelize aggressively or run sub-minute sweeps across large client books, the Enterprise tier raises limits and can add a dedicated pool.

Q / 05

Can the output feed directly into my client portal?

Yes — the response is a normalized JSON schema. Most MSSPs write it into a Postgres / SQLite store and render from there. The fields are stable; versioned changes are announced in the changelog.

Q / 06

What about white-labelling the scanner for clients to self-serve?

That is an Enterprise-tier conversation — custom branding and direct client API keys are not on the self-serve plans. Most MSSPs on Professional wrap the API behind their own portal instead, which is the cleaner model anyway.