Keep discovered surface current and tested.
Continuous ASM is ShakerScan’s attack-surface workflow. It maintains a per-target endpoint inventory built from scans, crawling, JavaScript, API artifacts, and discovery, tracks which proof families have covered each endpoint, and recommends the next bounded action: more discovery, an endpoint test batch, a focused SQLi, XSS, auth, or BOLA wave, or waiting for active work to finish.
Who it is for. AppSec and platform teams responsible for a surface that changes faster than any one-off assessment can track.
What problem it solves
A one-shot scan answers “what did this assessment find?” It does not answer “what remains untested, and what bounded work should run next?” Continuous ASM answers the second question and keeps the inventory current as the surface changes.
Subdomain discovery and certificate-transparency monitoring feed the same inventory, so a newly issued certificate or a new host becomes a coverage gap you can act on rather than a surprise.
How it works
- 01Add an authorized web target. New web targets receive a conservative Continuous ASM policy by default; existing targets are never changed silently.
- 02ShakerScan normalizes endpoints from scans, crawling, JavaScript assets, API artifacts, discovery, and application-graph facts into one inventory.
- 03Open Attack surface → Coverage, review proof-family coverage and gaps, and choose Improve coverage to schedule the next bounded wave.
- 04Subfinder-based subdomain discovery and Gungnir certificate-transparency monitoring add new hosts over time.
- 05The exposure graph and application graph connect assets, technologies, relationships, and coverage gaps into one reviewable surface.
What you get
- An endpoint inventory with proof-family coverage state per endpoint.
- Coverage gaps, recommended next actions, and an activity timeline.
- Subdomain and certificate-transparency discoveries attached to the same target.
- Exposure and application graphs, plus schedules for recurring discovery.
Example workflow
curl http://localhost:8080/targets/{target_id}/asm/gaps curl -X POST http://localhost:8080/targets/{target_id}/asm/improve \ -H "Content-Type: application/json" \ -d '{"batch_size":50,"stale_days":30}'
Security and authorization
- Continuous ASM generates bounded background discovery and test traffic against the target. Only enable it for surfaces you are authorized to test continuously.
- Deep exploit mode stays off unless explicitly enabled. Authenticated checks require a primary auth context; BOLA testing also requires a distinct second user and explicit deep intent.
- Global defaults live under Settings → Scan execution; each target keeps its own policy.
Limitations
- The inventory is only as complete as discovery reached. Coverage state is a record of work done, not proof that untested endpoints are safe.
- Certificate-transparency monitoring depends on the availability of public CT logs.
- Recommended waves are bounded by the target’s policy and budgets; large surfaces take multiple waves to cover.
Get started
- 01Install ShakerScan and add an authorized web target under Targets.
- 02Open Attack surface → Coverage and select the target.
- 03Review the policy and gaps, then choose Improve coverage.
- 04Optionally enable Gungnir certificate-transparency monitoring for the root domain.