Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Most tools will only test the domains you already know about. We’ve decided that’s not enough. TLDR: Detectify’s new Apex Discovery automatically identifies root domains likely to belong to your organization (from M&A, subsidiaries, and shadow IT) for complete security coverage. Review and confirm our curated suggestions in a click, and instantly start protecting them with the same continuous discovery and vulnerability assessment as the rest of your attack surface.

For years, development and security practitioners have treated dynamic application security testing as a critical final safety check before code goes live. However, the external attack surface is expanding faster than mid-sized security teams can realistically manage. In this high-velocity environment, legacy DAST tools are increasingly failing to keep pace.

Scaling application security and attack surface monitoring inside a single enterprise is a massive headache. In June 2026, the Department for Science, Innovation and Technology (DSIT) of the UK Government joined us on stage at Infosecurity Europe to share the reality of a challenge that puts even the largest corporate hurdles into perspective.

Attack Surface Monitoring has become a critical component of modern cybersecurity programs. As organizations scale their cloud environments, applications, APIs, and third-party services, so does their external attack surface. Every new cloud instance, API endpoint, marketing microsite, and third-party SaaS tool expands your perimeter. But there are two hard truths for security teams: You cannot protect what you don’t know exists, and you cannot secure what you don’t deeply test.

We are launching the Detectify MCP Server to deliver real-time vulnerability data and attack surface insights directly into your AI-powered workflows. Built for developers and AppSec teams using Claude Code, Cursor, ChatGPT, and Claude Desktop, it delivers security data straight to your AI assistants via a remote-hosted server, giving you hacker-proof guardrails without adding anything new to deploy or maintain.

In the world of application security, vulnerabilities are always a moving target. As modern applications keep becoming increasingly API-driven, cloud-native, and dependent on third-party services, the attack surface has expanded dramatically. For years, the OWASP Top 10 has served as the North Star for security professionals, providing a consensus-based ranking of the most critical web application security risks.

Security doesn’t stop at the perimeter. The “inside” of your network often harbors many overlooked risks. To address this, ealier this year we launched Detectify Internal Scanning, designed to bring our world-class vulnerability research directly into your private ecosystems.

Let’s be real. Shadow AI is already reshaping Shadow IT Security, whether organizations are ready or not. Chances are that your developers aren’t waiting for a formal RFP to start using AI. They’re already deep in the trenches, using Open WebUI to manage models or shipping entire projects through platforms like Lovable at a velocity that makes traditional AppSec look like it’s standing still.

Maintaining a secure external attack surface is no longer just about finding vulnerabilities; it’s about proving your resilience to partners, auditors, and regulatory bodies. Today, we are excited to announce Detectify’s PCI ASV Scanning, delivered in partnership with Clone Systems.

TLDR: We attended Cyber Security 2026: Kritisk infrastruktur in Stockholm, and the reality check was simple: “breakout time” has hit a record low of 29 minutes. If you’re still scanning monthly, you’re defending a version of your infrastructure that doesn’t exist anymore. The time it takes for an attacker to move after a breach has dropped to just 29 minutes. In 2021, we talked about a “breakout time” of 100 minutes. Today?