简体中文
EnglishWhat Is ThreatPort and What Does It Do?
Updated
ThreatPort is an external attack surface management (EASM) and cyber threat intelligence (CTI) platform that maps what your organization exposes on the public internet. It is built for IT managers, CISOs, CTOs, and small security teams that need practical security evidence without waiting on enterprise sales cycles or commissioning expensive manual assessments. You start with a free domain scan; continuous monitoring and deeper analysis sit behind a paid plan.
What problem it solves
Most organizations learn about an exposed service, a forgotten subdomain, or a missing email authentication record only when an attacker, an auditor, or a customer points it out. ThreatPort's stated goal is to reverse that order: know your attack surface before attackers do. It does this by scanning from the outside in, using only publicly visible information, so nothing needs to be installed on your infrastructure.
Core capabilities
Based on the platform's own description, ThreatPort combines several functions in one self-serve workflow:
| Capability | What it covers |
|---|---|
| External attack surface management | Discovery of exposed assets and services reachable from the public internet |
| Cyber threat intelligence (CTI) | Threat context tied to your external footprint |
| CVE mapping | Technologies detected on your assets linked to known vulnerabilities |
| DNS and email security checks | Missing or weak SPF and DMARC records |
| SSL monitoring | Certificate issues on your endpoints |
| Open port visibility | Which ports and services are exposed |
| AI-assisted pentest reporting | Generated findings formatted for remediation and reporting |
The platform also flags weak HTTP headers and identifies technologies in use that may be associated with known CVEs.
How the workflow runs
- Start with a free domain scan. You enter a domain and ThreatPort discovers subdomains, exposed services, weak headers, missing SPF or DMARC records, certificate issues, and technologies that may map to known vulnerabilities.
- Review the findings. Results are presented in a dashboard described as a "command center for your digital risk," with an AI assistant for asking security questions directly.
- Move to continuous monitoring (paid). The paid plan adds ongoing monitoring, deeper external attack surface analysis, AI pentest output, and PDF-ready reporting.
The whole process is agentless — no installation, no agents on your hosts.
Who it fits
ThreatPort is positioned for lean teams rather than large security operations centers. If you are an IT manager or CTO who owns security alongside other responsibilities, or a CISO at a smaller organization without a dedicated external scanning program, the self-serve model removes the procurement friction that usually accompanies EASM tools. The reporting output is aimed at three audiences: engineers doing remediation, leadership needing updates, and compliance preparation.
Pricing and what you get
There is a free entry point: a domain scan with no stated installation requirement. The paid plan is listed at 50 USD per month per domain, which includes continuous monitoring, deeper external attack surface analysis, AI pentest output, and PDF-ready reporting. Pricing details are available on the platform's pricing page. Note that the free scan is a starting point, not a substitute for the continuous monitoring in the paid tier — if your exposure changes (and it does, every time someone spins up a new service), a one-time scan goes stale.
When to look elsewhere
ThreatPort covers the external view only. It does not replace endpoint detection, internal network monitoring, or a full vulnerability management program for systems behind your firewall. If you need agent-based host visibility or deep internal asset inventory, this is one input among several rather than a complete security stack. For teams whose main gap is "we don't know what's publicly exposed," it addresses that question directly and quickly.