Discovery runs continuously across your cloud accounts, repositories, container images, devices and the public internet. Every asset carries a posture derived from its real configuration, and anything nobody declared is flagged as exactly that.
Gartner's CTEM loop is five stages, and most tools stop after two. This one carries an exposure through to a finding with an owner and a date.
Cloud accounts, Kubernetes, repositories, container registries, DNS and endpoints. Assets arrive with their source recorded, so you can always ask where a thing came from.
An asset the platform found that nobody declared is called undeclared, not unknown. It is the difference between a gap in your inventory and a gap in your defences.
Misconfiguration checks against the live configuration, not a questionnaire. A control is marked met because something read it, with the timestamp attached.
Static analysis, dependency and secret scanning per repository, with licence noise kept apart from real defects so the counts mean something.
Exposure is scored to separate things, not to saturate. If six repositories all come out at critical, the score has told you nothing.
A confirmed exposure becomes a finding in the vulnerability lifecycle with an owner, a business unit and a due date, rather than a row on a list.
Netras flags CVEs present in CISA's Known Exploited Vulnerabilities catalogue, and says precisely what that means: this was exploited somewhere, at some point, which is a reason to prioritise it. It is not evidence that you are under attack, and the product will not imply it.
No. Cloud, repository and registry discovery is API-based and read-only. Device posture can use an agent where you want endpoint detail, and it is optional.
You mark it excluded, and it stops counting towards your estate everywhere at once: the counts, the posture, the reports. An excluded asset is not a deleted asset, so the record of the decision survives.
Yes. The platform ships as SaaS or on-prem, and the on-prem build is the same product rather than a reduced one.
A working demo with your data shape, not a slide deck.