HexaSentra Documentation

Discover, validate, and prioritize your external attack surface — and understand exactly why each finding is on your list.

Introduction

HexaSentra is an external attack surface management (EASM) platform. It works from the outside in — the same vantage point an attacker has — to continuously discover everything you expose to the internet, prove which exposures are real, and rank them with an explainable risk model. Every claim it makes is backed by an evidence artifact you can inspect.

Three ideas run through the whole product: discover everything, prove what's real, and explain the priority.

Getting started

Sign in. Access is provisioned by our team — sign in at app.hexasentra.com with the credentials you were given, then change your password (minimum 12 characters).

Add a domain to scope. On Scope & Scans, add a root domain you own or are authorized to assess.

Authorize (for active scanning). Passive discovery runs immediately and touches nothing. Active scanning requires you to confirm authorization, recorded against your name.

Run a scan. Start it from Scans or the Scope page. Results stream onto the dashboard as they land.

Nothing is actively scanned without a verified authorization — the gate is enforced in the data path, not just the UI.

Core concepts

Assets

Domains, subdomains, IPs, cloud resources, and the services running on them. Each asset carries an ownership-confidence score so you can tell what's genuinely yours.

Observations & evidence

Every fact HexaSentra records is an observation tied to an immutable, content-addressed evidence artifact — the response, record, or certificate that produced it. Observations are append-only; history is never rewritten.

Findings

A finding is a specific exposure on an asset. It carries its detection rule, evidence, a validation verdict, and an explainable risk score.

Attribution

Probabilistic, evidence-anchored reasoning about which assets belong to your organization. Low-confidence assets are shown for visibility but never counted in your risk totals.

Scanning & scope

Passive vs. active

Passive discovery uses public sources (certificate transparency, DNS, historical data) and sends no packets to the target. It needs no authorization.
Active discovery probes the target directly and requires verified, authorized scope.

Managing scans

The Scans page lists every run with its status, duration, and results. You can start a scan, stop a queued or running one, delete a single run, or purge all scan data for the org from the danger zone.

Revoking a domain in Scope also cancels any scan it authorized — access and activity stop together.

Findings & validation

HexaSentra separates detection from validation. A detector says "this looks wrong." A validator then runs a disproof control — it actively tries to prove the finding false. Only a finding that survives that test is confirmed, and only a confirmed finding can reach the top severities.

Triage & lifecycle

Dismiss (false positive) — the finding is suppressed and stays suppressed across future scans.
Accept risk — acknowledged and set aside, with a reason.
Mark fixed — resolved; if the exposure is detected again it re-opens automatically as a logged regression.

Every triage action is recorded in an audit trail.

Risk scoring

Risk is a transparent, multiplicative model: a base severity scaled by exposure, exploitability, confidence, and other factors. Confidence multiplies — it never pads the number — so an unvalidated finding is capped below High until a control confirms it. Every score shows its arithmetic.

Composite exposure

Each asset also gets a composite exposure score that rolls up all its open findings into one attacker's-view number, so you can rank assets, not just findings.

Capabilities

Subdomain takeover — dangling-DNS detection across 40+ providers, confirmed by each provider's own unclaimed-resource fingerprint.
Cloud & storage exposure — publicly readable buckets and misconfigured endpoints.
Data-leak discovery — secrets in client JavaScript, exposed config and source, gathered into one view.
Screenshots & change monitoring — a visual gallery of your live surface and a feed of what changed.
Exploit intelligence — CISA KEV and EPSS overlaid onto findings.
Technology fingerprinting — precise product and version detection feeding CVE correlation.

API & MCP

HexaSentra exposes a REST API and a Model Context Protocol (MCP) server, so your own automation and AI agents can query the attack surface directly.

MCP server

claude mcp add hexasentra \
  --env HEXASENTRA_API_KEY=<your-key> \
  -- node --experimental-strip-types /path/to/apps/mcp/index.ts

Tools include attack-surface summary, asset search, findings, related domains, and recent changes. MCP is available on plans where the feature is enabled.

Admin & access

Organization owners manage their own team from Team — invite members and assign roles (owner, admin, analyst, viewer). Access to the product follows your subscription: a trial or paid period is enforced automatically and needs no manual cleanup when it ends.

Staff-provisioned accounts arrive with a temporary password that must be changed on first sign-in.