threatport.com

ThreatPort's paid plan costs 50 USD per month per domain. According to the site's own description, it adds continuous monitoring, deeper external attack surface analysis, AI pentest output, and PDF-ready reporting on top of the free domain scan. That price and feature set make it a fit for lean security teams that want recurring evidence rather than a one-time assessment — but it is priced per domain, so the total scales with how many domains you need to cover.

What the paid plan includes

Based on the platform description, the paid tier covers:

• Continuous monitoring — the external attack surface is checked on an ongoing basis instead of only when you run a scan.
• Deeper external attack surface analysis — more thorough coverage than the free scan.
• AI pentest output — AI-assisted pentest reporting, described as part of the self-serve workflow.
• PDF-ready reporting — output intended for remediation tracking, leadership updates, and compliance preparation.

These sit on top of the capabilities the platform advertises across its tiers: external attack surface management, cyber threat intelligence, CVE mapping, DNS and email security checks (including SPF and DMARC), SSL monitoring, and open port visibility.

What you get before paying

ThreatPort offers a free domain scan as the entry point. Per the site, that scan can surface:

• Subdomains
• Exposed services
• Weak headers
• Missing SPF or DMARC records
• Certificate issues
• Technologies that may be linked to known vulnerabilities

The platform is agentless and requires no installation, so the free scan is a way to see real findings on your own domain before deciding whether the recurring monitoring is worth 50 USD per month.

How to decide whether it's worth it

The paid plan is priced per domain per month, so the practical question is how many domains you need under continuous watch and whether you need the reporting output.

The site positions the product for IT managers, CISOs, CTOs, and lean security teams that want "practical security evidence without waiting for enterprise sales calls or expensive manual assessments." If that describes your team and you need recurring rather than one-off results, the 50 USD per domain per month is the number to plan around.

What to verify before buying

The description does not specify billing terms, contract length, or whether the price changes at volume. Check the pricing page directly for current terms, and confirm whether the domains you care about (including subdomains you don't yet know about) fall under a single domain charge or count separately. Running the free scan first on your primary domain is the cheapest way to judge whether the findings justify the recurring cost.

A free ThreatPort domain scan reveals what your domain exposes on the public internet: subdomains, exposed services, open ports, SSL certificate issues, DNS and email security gaps such as missing SPF or DMARC records, and technologies that may be linked to known vulnerabilities. It is a self-serve, agentless starting point — no installation or sales call required — intended for IT managers, CISOs, CTOs, and lean security teams who want practical security evidence before attackers, auditors, or customers find the same exposure. The free scan is a discovery step; continuous monitoring and deeper analysis sit in the paid plan.

Subdomains and exposed services

The scan starts from a single domain and maps what is publicly reachable, including subdomains you may not have inventoried. This matters because forgotten or shadow subdomains are a common way an organization's real footprint grows beyond what the internal team tracks.

What the scan surfaces here:

• Subdomains associated with your domain, including ones outside your current asset list
• Exposed services running on those hosts
• Weak or missing HTTP security headers, which affect how browsers enforce protections on your sites

The practical value is reconciliation: compare the discovered list against your own records. Anything you cannot account for is worth investigating first.

Open ports and SSL certificate problems

Open port visibility shows which services are reachable from the public internet. Certificate monitoring flags issues with the TLS certificates protecting those services.

Look for:

• Open ports that expose services you did not intend to publish
• Certificate issues such as expiring, misconfigured, or otherwise problematic SSL/TLS certificates

Expired or misconfigured certificates are both a trust problem (browser warnings for customers) and an operational one (broken integrations). Because certificates expire on a schedule, a one-time scan is a snapshot — this is exactly the kind of finding that continuous monitoring in the paid plan is designed to catch before it lapses.

DNS and email security risks

The scan checks DNS and email security configuration, including missing SPF or DMARC records. These records control whether others can send email that appears to come from your domain and how receiving mail servers should treat it.

A missing or weak SPF/DMARC setup means your domain is easier to spoof in phishing and business email compromise attempts aimed at your customers, partners, or staff. This is one of the more actionable categories from a free scan because the fix is usually a DNS record change rather than an infrastructure project — and it is also the kind of gap auditors and security questionnaires tend to ask about.

Technologies linked to known vulnerabilities

The scan identifies technologies in use and maps them against known vulnerabilities (CVEs). This connects what you are running to what is publicly documented as exploitable.

Treat this as a prioritization signal, not a verdict:

• A flagged technology means it may be linked to known vulnerabilities — you still need to confirm the version and configuration in use.
• CVE mapping helps you decide which exposures to remediate first, based on what is publicly known rather than guesswork.

What the free scan is and is not

The paid plan is priced at 50 USD per month per domain. If you only need a point-in-time view of what is exposed, the free scan answers that question. If you need ongoing monitoring, deeper analysis, or reports you can hand to leadership or auditors, that is what the paid tier adds.

How to get useful results from the free scan

1. Run the scan against your primary domain. The platform is agentless and self-serve, so no installation or onboarding call is needed.
2. Export or record the findings across the categories above — subdomains, services, ports, certificates, DNS/email records, and flagged technologies.
3. Reconcile against your known inventory. Flag any subdomain or service you cannot explain.
4. Fix the cheap, high-impact items first. Missing SPF/DMARC records and expiring certificates are typically quick wins with clear ownership.
5. Confirm before escalating CVE findings. Verify the actual version and exposure of any flagged technology before treating it as confirmed.
6. Decide whether a snapshot is enough. If your footprint changes often or you need audit-ready reporting, the continuous monitoring and reporting in the paid plan address the gaps a one-time scan leaves open.

The scan tells you what is visible from the outside. What you do with that list — and whether you need to keep watching it — is the decision the results should drive.

ThreatPort combines external attack surface management (EASM) with cyber threat intelligence (CTI) and CVE mapping in a single self-serve workflow. It scans your public-facing domains, subdomains, services, certificates, DNS, and email records, then links the technologies and exposed services it finds to known vulnerabilities. The result is a prioritized view of what is exposed and why it matters, rather than a raw list of open ports. This is aimed at IT managers, CISOs, CTOs, and lean security teams that need practical security evidence without enterprise sales cycles or manual assessments.

How CTI and attack surface data come together

The core idea is that an exposed asset only becomes a risk in context. ThreatPort starts from the outside in:

1. Discovery — A scan maps your external footprint: subdomains, exposed services, open ports, weak headers, missing SPF or DMARC records, certificate issues, and the technologies in use.
2. Enrichment — That inventory is combined with cyber threat intelligence and CVE data, so each finding is tied to what is publicly known about the technology or service.
3. Prioritization — Findings are surfaced with enough context to judge urgency, so teams can focus remediation instead of triaging everything equally.

Because the platform is agentless and requires no installation, the input is simply your domain. The action is a scan; the expected result is a mapped external attack surface with intelligence layered on top.

How CVE mapping connects exposed assets to known vulnerabilities

CVE mapping is the bridge between "this service is visible on the internet" and "this service may be exploitable." ThreatPort identifies technologies and services during discovery, then associates them with known CVEs. That turns a neutral observation like an open port or an outdated component into a finding with a vulnerability reference.

The practical value is remediation priority: instead of patching by guesswork, you can order work by what is both exposed and known-vulnerable.

AI-assisted answers and pentest reporting

ThreatPort includes AI-assisted security Q&A and AI pentest output. The dashboard is described as a command center for digital risk where you can "ask anything" and get instant security answers, and the paid plan produces PDF-ready reporting.

• AI Q&A helps interpret findings without needing a specialist on hand — useful for lean teams.
• AI pentest output turns scan results into a structured, report-style artifact.
• PDF-ready reporting supports remediation tracking, leadership updates, and compliance preparation.

These outputs matter because the same evidence serves three audiences: engineers fixing issues, executives needing a summary, and auditors or customers asking for proof of diligence.

What this means for remediation and compliance

The combination of continuous monitoring, CTI, and CVE mapping supports a repeatable loop:

1. Scan and discover what is exposed.
2. Map findings to known vulnerabilities and threat context.
3. Prioritize and remediate.
4. Export reporting for leadership and compliance.

ThreatPort is positioned for organizations that need this evidence "without waiting for enterprise sales calls or expensive manual assessments." The paid plan is priced at 50 USD per month per domain and includes continuous monitoring, deeper external attack surface analysis, AI pentest output, and PDF-ready reporting. A free domain scan is available to start, which reveals subdomains, exposed services, weak headers, missing SPF or DMARC records, certificate issues, and technologies that may be linked to known vulnerabilities.

Choosing based on your situation

• If you need a quick, no-install view of exposure: start with the free domain scan to see subdomains, services, headers, DNS/email gaps, and certificate issues.
• If you need ongoing monitoring and reporting: the paid plan adds continuous monitoring, deeper analysis, AI pentest output, and PDF-ready reports at 50 USD per month per domain.
• If you are preparing for audits or leadership updates: the reporting outputs are the relevant feature, since they convert technical findings into shareable evidence.

For current pricing details and any plan limitations, check the pricing page directly, since terms can change.

ThreatPort is a self-serve, agentless external attack surface management (EASM) and cyber threat intelligence (CTI) platform. It differs from manual security assessments and enterprise sales-led tools in three practical ways: you can start without a sales call or installation, monitoring is continuous rather than a one-time snapshot, and output is designed as usable security evidence for lean teams. The paid plan is priced at 50 USD per month per domain, per the site's page evidence.

The core differences at a glance

Where manual assessments still make sense

Manual assessments (penetration tests, consultant-led reviews) remain valuable when you need deep, human-verified exploitation testing, regulatory attestation, or adversarial simulation that goes beyond external visibility. ThreatPort's scope is external: what is exposed on the public internet. If your requirement is an auditor-signed penetration test report, a platform scan is a complement, not a replacement.

Where enterprise sales-led tools differ

Enterprise tools often bundle broader capabilities (internal asset management, SIEM integration, custom contracts). The trade-off is time-to-value: you typically wait through demos, security reviews, and procurement before seeing your own data. ThreatPort's model is the opposite — a free domain scan surfaces findings first, and the paid plan adds continuous monitoring, deeper analysis, AI pentest output, and reporting.

What ThreatPort actually checks

Based on the platform description, a scan can reveal:

• Subdomains and exposed services
• Open ports
• CVEs mapped to detected technologies
• SSL certificate issues
• DNS and email security gaps, including missing SPF or DMARC records
• Weak HTTP headers

This maps to the "know your attack surface before attackers do" positioning: the goal is finding exposure before attackers, auditors, or customers do.

Who this fits

ThreatPort is aimed at IT managers, CISOs, CTOs, and lean security teams that need practical security evidence without waiting for enterprise sales calls or paying for expensive manual assessments. If you have a small team, limited budget, and a need to show remediation progress to leadership or prepare for compliance, the self-serve model removes the procurement bottleneck.

If you need deep internal network testing, signed attestation reports, or a heavily customized enterprise contract, a manual assessment or enterprise platform may still be the right primary tool — with ThreatPort as an external-visibility layer.

How to decide

1. Start with the free domain scan to see what is actually exposed. This costs nothing and requires no installation.
2. Compare findings against your current process. If a manual assessment already covers the same external surface, check whether continuous monitoring would catch changes between engagements.
3. Evaluate the paid plan (50 USD per month per domain) if you need continuous monitoring, deeper analysis, AI pentest output, and PDF-ready reporting.
4. Keep manual assessments for scenarios requiring human-verified exploitation or formal attestation.

The key question is not which approach is "better" but whether you need a one-time deep test, a broad enterprise platform, or continuous external visibility you can act on without a sales cycle.

ThreatPort is an external attack surface management (EASM) and cyber threat intelligence (CTI) platform that maps what your organization exposes on the public internet. It is built for IT managers, CISOs, CTOs, and small security teams that need practical security evidence without waiting on enterprise sales cycles or commissioning expensive manual assessments. You start with a free domain scan; continuous monitoring and deeper analysis sit behind a paid plan.

What problem it solves

Most organizations learn about an exposed service, a forgotten subdomain, or a missing email authentication record only when an attacker, an auditor, or a customer points it out. ThreatPort's stated goal is to reverse that order: know your attack surface before attackers do. It does this by scanning from the outside in, using only publicly visible information, so nothing needs to be installed on your infrastructure.

Core capabilities

Based on the platform's own description, ThreatPort combines several functions in one self-serve workflow:

The platform also flags weak HTTP headers and identifies technologies in use that may be associated with known CVEs.

How the workflow runs

1. Start with a free domain scan. You enter a domain and ThreatPort discovers subdomains, exposed services, weak headers, missing SPF or DMARC records, certificate issues, and technologies that may map to known vulnerabilities.
2. Review the findings. Results are presented in a dashboard described as a "command center for your digital risk," with an AI assistant for asking security questions directly.
3. Move to continuous monitoring (paid). The paid plan adds ongoing monitoring, deeper external attack surface analysis, AI pentest output, and PDF-ready reporting.

The whole process is agentless — no installation, no agents on your hosts.

Who it fits

ThreatPort is positioned for lean teams rather than large security operations centers. If you are an IT manager or CTO who owns security alongside other responsibilities, or a CISO at a smaller organization without a dedicated external scanning program, the self-serve model removes the procurement friction that usually accompanies EASM tools. The reporting output is aimed at three audiences: engineers doing remediation, leadership needing updates, and compliance preparation.

Pricing and what you get

There is a free entry point: a domain scan with no stated installation requirement. The paid plan is listed at 50 USD per month per domain, which includes continuous monitoring, deeper external attack surface analysis, AI pentest output, and PDF-ready reporting. Pricing details are available on the platform's pricing page. Note that the free scan is a starting point, not a substitute for the continuous monitoring in the paid tier — if your exposure changes (and it does, every time someone spins up a new service), a one-time scan goes stale.

When to look elsewhere

ThreatPort covers the external view only. It does not replace endpoint detection, internal network monitoring, or a full vulnerability management program for systems behind your firewall. If you need agent-based host visibility or deep internal asset inventory, this is one input among several rather than a complete security stack. For teams whose main gap is "we don't know what's publicly exposed," it addresses that question directly and quickly.