Manufacturing & OT
Find reachable PLC, SCADA and fieldbus services such as Modbus, S7comm, EtherNet/IP and PROFINET before an attacker does.
- ICS/SCADA
- Segmentation checks
Self-hosted security operations
Continuous visibility across IT, OT and IoT.
Comprehensive discovery scanning of massive CIDR ranges, attack surface management, OT/IoT and vulnerability scanning, self-hosted in your own perimeter.
Runs inside your networkRead-only OT probingSARIF 2.1.0 export
Discover
Sweep huge CIDR ranges into named groups of live hosts.
Assess
130+ exposure checks, 64 OT/IoT protocols and a plugin-driven vulnerability scanner.
Prioritize
A fix-first score weighing severity, CISA KEV, EPSS and asset criticality.
Report
HTML, PDF, CSV and JSON exports, plus SARIF 2.1.0 for your pipeline.
Platform capabilities
One console for the whole exposure workflow
From the first sweep of an address range to a report your engineers can act on. Discovery, assessment and prioritization share one set of assets, groups and findings.
Know what is on the network, at any scale
Fast live-host sweeps built on nmap host discovery, designed for large internal address space.
- Sweep CIDR ranges, IP ranges, lists and hostnames in nmap target syntax, with no cap on range size
- New live hosts are appended to a named target group; nothing is removed, so repeated sweeps build lasting coverage
- Tunable packet rate, timing template, retries and per-host timeout, with live progress
- Passive OS and device hints from reply TTL and MAC vendor, plus reverse-DNS names
- A guard flags sweeps where an implausible share of a range answers (proxy-ARP or RST-everything devices)
Audit exposed services and legacy protocols
A read-only audit of 130+ legacy-protocol and exposed-service checks, built for internal infrastructure as well as the perimeter.
- Ten module groups: plaintext protocols, weak TLS, Windows/SMB/Active Directory, remote access, network infrastructure, cloud metadata, containers, databases, IoT messaging, and dev tools & admin panels
- Targets as IPs, hostnames or IPv4 CIDRs with no CIDR-size cap; tune concurrency and per-probe timeout
- Every scan belongs to a named group, so repeated audits accumulate coverage over time
- Each finding carries a severity and concrete remediation guidance
threatlark / attack-surface-management
Find exposed industrial and IoT services safely
A dedicated OT/IoT Exposure scanner covering 64 industrial, building-automation, energy and IoT protocols.
- Protocols include Modbus/TCP, Siemens S7comm, DNP3, EtherNet/IP, IEC 60870-5-104, OPC UA, BACnet/IP, PROFINET, MQTT and more
- Every hit is confirmed with a single safe, read-only protocol handshake, never a write, start, stop, program or login
- Only stock, non-intrusive nmap scripts are used; an optional UDP pass and per-host timeout keep sweeps in check
- Severity reflects impact of exposure, with remediation focused on segmentation and access restriction
Internet-exposed ICS18
- Siemens S7comm
- Modbus/TCP
- DNP3
- EtherNet/IP
- IEC 60870-5-104
- Omron FINS
- OPC UA
- BACnet/IP
Core ICS / SCADA9
- PROFINET
- EtherCAT
- Fanuc FOCAS
- SECS/GEM
- MTConnect
PLC / vendor engineering5
- Beckhoff ADS
- Metasys N1
- HMS HICP
Building automation5
- KNXnet/IP
- LonWorks
- Crestron
- Art-Net
Energy / metering / traffic5
- DLMS/COSEM
- IEEE C37.118
- BSAP
- SNMP / NTCIP
IoT / IIoT16
- MQTT
- AMQP
- CoAP
- RTSP
- DoIP
- SSDP / UPnP
- mDNS
Cameras / SCADA apps6
- Hikvision
- Dahua
- Ignition
- Kepware
- WinRM
64
protocol checks, each confirmed by a safe, read-only handshake
Critical (20)High (36)Medium (8)
Layered vulnerability scanning with a plugin chain
The New Scan engine combines core web checks with an optional chain of 20+ best-in-class open-source scanners.
- Core web checks: headers, TLS, technology detection, CORS, HTTP methods, open redirect and XSS
- Optional plugin chain including nuclei, httpx, subfinder, naabu, dalfox, sqlmap, retire.js and an OpenAPI spec audit
- Normal, Deep and Comprehensive presets, or choose exactly which checks run
- Findings from several tools for the same issue are merged into one corroborated entry
threatlark / history / scan
From findings to fix-first decisions and shareable reports
De-duplicated findings, a documented priority score and exports that fit the way your team already works.
- Priority score blends severity with CISA KEV, EPSS, public-exploit signals and asset criticality
- Per-scan reports in HTML, PDF, CSV and JSON, plus an executive-summary PDF
- SARIF 2.1.0 export for code-scanning dashboards, DefectDojo and CI pipelines
- SLA tracking, program metrics and a customizable dashboard
Fix-first priority score (0-100)
Severity baseup to +40
CISA KEV (exploited)+30
EPSS probabilityup to +15
Public exploit exists+10
Exposure tool (OT, auth spray)+8
Asset criticality-12 to +20
Export formats
- HTML
- CSV
- JSON
- SARIF 2.1.0
Also included: WordPress Scanner, API Security Scanner, Container Scanner, Network Auth Spray, Secret Scanner, CVE and IOC lookup, ThreatPulse, and 16 standalone recon tools. See everything in the platform.
Solutions
View in detailBuilt for the networks that are hardest to see
Healthcare IoT
Surface exposed device services (RTSP cameras, JetDirect printers, MQTT brokers, UPnP responders) across networks you are responsible for.
- Connected devices
- Discovery
Financial services
Audit internal infrastructure for legacy protocols, weak TLS and unauthenticated databases, with a tamper-evident audit trail.
- Internal audits
- Audit log
MSSPs
Per-user, per-tool permissions, shareable target groups and scheduled scans for running assessments across multiple environments.
- Access control
- Scheduling
These are example use cases for the platform’s capabilities, not customer endorsements.
Enterprise-grade security built in
Argon2id
Memory-hard password hashing
TOTP MFA
Authenticator-app second factor
WebAuthn passkeys
Hardware and platform authenticators
Microsoft SSO
Invite-only Entra ID sign-in
RBAC
Per-user, per-tool access levels
Audit log
Hash-chained and tamper-evident
Deployment
View all optionsDeploy where your data lives
ThreatLark is self-hosted: scan data, credentials and reports stay inside your environment.
Bare-metal
A distro-aware installer for Kali/Debian and RHEL families. It installs prerequisites, generates secrets and TLS, builds, and starts the service.
Docker
docker compose up -d --build builds an image with every scanner binary baked in. State lives in a single named volume.
Browser extension
A Manifest V3 companion that runs tech-detect, SSL/TLS, port, WHOIS and CVE lookups on the current tab through your signed-in session.
See ThreatLark in action
Book a walkthrough and see discovery, exposure scanning and prioritized findings running on your own network ranges.