Continuous ASM · coverage loop
Keep discovered surface current and tested.
Continuous ASM keeps an endpoint inventory per target, shows which endpoints lack proof coverage, and recommends the next bounded action: more discovery, an endpoint test batch, an SQLi, XSS, or BOLA wave, or waiting for active work to finish.
Who it is for. AppSec and platform teams responsible for a surface that changes faster than any one-off assessment can track.
What problem it solves
A one-shot scan answers “what did this assessment find?” It does not answer “what remains untested, and what bounded work should run next?” Continuous ASM answers the second question and keeps the inventory current as the surface changes.
Subdomain discovery and certificate-transparency monitoring feed the same inventory, so a new host shows up as a coverage gap.
How it works
- 01Add an authorized web target. New web targets receive a conservative Continuous ASM policy by default; existing targets are never changed silently.
- 02ShakerScan normalizes endpoints from scans, crawling, JavaScript assets, API artifacts, discovery, and application-graph facts into one inventory.
- 03Open Attack surface → Coverage, review proof-family coverage and gaps, and choose Improve coverage to schedule the next bounded wave.
- 04Subfinder-based subdomain discovery and Gungnir certificate-transparency monitoring add new hosts over time.
- 05The exposure graph and application graph connect assets, technologies, relationships, and coverage gaps into one reviewable surface.
What you get
- An endpoint inventory with proof-family coverage state per endpoint.
- Coverage gaps, recommended next actions, and an activity timeline.
- Subdomain and certificate-transparency discoveries attached to the same target.
- Exposure and application graphs, plus schedules for recurring discovery.
Example workflow
Read the gaps, then improve coverageshell
curl http://localhost:8080/targets/{target_id}/asm/gaps curl -X POST http://localhost:8080/targets/{target_id}/asm/improve \ -H "Content-Type: application/json" \ -d '{"batch_size":50,"stale_days":30}'
Security and authorization
- Continuous ASM generates bounded background discovery and test traffic against the target. Only enable it for surfaces you are authorized to test continuously.
- Deep exploit mode stays off unless explicitly enabled. Authenticated checks require a primary auth context; BOLA testing also requires a distinct second user and explicit deep intent.
- Global defaults live under Settings → Automation; each target keeps its own policy.
Limitations
- The inventory is only as complete as discovery reached. Coverage state is a record of work done, not proof that untested endpoints are safe.
- Certificate-transparency monitoring depends on the availability of public CT logs.
- Recommended waves are bounded by the target’s policy and budgets; large surfaces take multiple waves to cover.
Get started
- 01Install ShakerScan and add an authorized web target under Targets.
- 02Open Attack surface → Coverage and select the target.
- 03Review the policy and gaps, then choose Improve coverage.
- 04Optionally enable Gungnir certificate-transparency monitoring for the root domain.
Related product areas
ScanRun repeatable web and API security tests with explicit active-testing controls, retained findings, evidence, coverage information, and retesting.Connected devicesInventory and assess authorized TVs, cameras, printers, routers, NAS systems, and appliances with coverage profiles, safety profiles, and a health circuit breaker.All product areas