Map your attack surface
before someone else does

ApifyForge helps security teams map their external attack surface by combining subdomain discovery, DNS lookups, NVD CVE searches, and certificate transparency actors. Best for weekly asset inventory and vulnerability triage across 10-200 domains. Less suitable for continuous real-time perimeter monitoring. Costs $0.05-$0.15 per scan.

The problem

Security teams need to continuously discover their external attack surface — subdomains, exposed services, vulnerable software, and certificate issues. Commercial ASM platforms cost $10,000+/year. Manual OSINT takes hours per domain.

The solution

Apify actors connect to public security databases: NVD for CVEs, crt.sh for certificate transparency, DNS lookups for infrastructure mapping, and CISA KEV for actively exploited vulnerabilities. Run batch queries and get structured results for your security team.

How it works

1

List your domains

Start with your primary domains and known subdomains. Certificate transparency searches often reveal subdomains you did not know existed.

2

Run discovery actors

Use crt.sh search for subdomain discovery, DNS record lookup for infrastructure mapping, and NVD CVE search for vulnerability identification.

3

Prioritise findings

Cross-reference discovered assets with CISA's Known Exploited Vulnerabilities catalog. Focus remediation on actively exploited CVEs first.

4

Monitor continuously

Schedule weekly runs to catch new subdomains, certificate changes, and newly disclosed vulnerabilities affecting your tech stack.

What does it cost?

Scanning 50 domains across 4 security databases costs $5-10 in PPE charges. Weekly monitoring of 20 domains: $10-20/month. Compared to $10,000+/year for commercial ASM.

Estimate your cost →

Ready to get started?

Sign in and set up the CLI in under 2 minutes. Your Apify token stays on your machine.

Related workflows