Probe inside the target
A probe deployed inside the target network enumerates reachable hosts, open services and versions. Agentless, credential-free to start, and confined to the scope you agree in writing.
Agentless · removable
IT due-diligence discovery platform
See the whole estate. Clearly.
Sightscope maps an acquisition target’s infrastructure in days: every reachable host, service and exposure, correlated against known vulnerabilities and end-of-life software, with the evidence behind each finding.
Discovery and evidence collection. No exploitation, no persistence.
80/tcp http · IIS 8.5 External
443/tcp https · IIS 8.5 External
3389/tcp ms-wbt-server External
445/tcp microsoft-ds · SMB Internal
6 services observed on this host
Evidence
- Scan
- DR-2026-0184
- Host
- 203.0.113.17
- Observed
Critical End-of-life OS, externally reachable
The detected version is past end of support and the host answers an administrative interface from outside the perimeter.
§ 01 · The problem
The IT chapter of the report is usually written from an interview.
Technical due diligence often runs on a questionnaire and two calls with an IT manager who is not incentivised to volunteer bad news. The result is a chapter built on assertion — and integration cost discovered after closing, when the price is already fixed.
- Asset inventories are stale, partial, or maintained in a spreadsheet nobody owns.
- End-of-life systems and unmanaged exposure surface during integration, not diligence.
- Findings cannot be reproduced later, so they cannot carry weight in a negotiation.
Capabilities
- 01 Asset and service inventory
- Every reachable host with its open ports, detected services and versions, classified by asset type and grouped by site.
- 02 Exposure mapping
- What is reachable from outside, what is reachable laterally, and which administrative interfaces are answering when they should not be.
- 03 Vulnerability and EOL correlation
- Detected versions matched against a locally mirrored CVE dataset and end-of-life calendars — no live queries that would leak the target’s estate to a third party.
- 04 Evidence trail
- Every finding carries the scan, host and timestamp that produced it — reproducible months later during negotiation or dispute.
§ 02 · Capabilities
What the scan actually produces.
An inventory the target could not have assembled from memory: what is reachable, what it is running, which version, and what that version is known to be exposed to. The three views below are one application.
This is the product’s own component vocabulary rendered live in the page, not a screenshot of it. Every address is documentation space and every panel is a specimen.
§ 03 · How it works
Discover, correlate, report.
An estate resolves in one pass: unknown addresses become named hosts, hosts declare their services, and the few that matter are marked against data the instrument already holds.
- 01
Discover
A probe deployed inside the target network enumerates reachable hosts, open services and versions. Agentless, credential-free to start, and confined to the scope you agree in writing.
- 02
Correlate
Findings are matched against a local vulnerability mirror, end-of-life data and exposure rules, then scored for business impact rather than raw severity.
- 03
Report
Technical detail for the engineers and NIS2 / DORA framing for the deal committee — generated from one evidence set, so both read the same facts.
§ 04 · Scope & safety
A read-only instrument, by design.
Sightscope observes. It does not exploit vulnerabilities, install agents, persist on hosts, or alter the systems it inspects — because a diligence tool that changes the target is a liability, not an asset.
- Nothing is exploited, so nothing can be broken during diligence — the target’s production estate is inspected in the state you found it in.
- Nothing persists, so the engagement leaves no residue to be discovered and explained after the transaction closes.
- Scope is written and bounded before the first packet, which is what makes the exercise defensible to both sides of the table.
Sightscope is not a penetration test, and does not present itself as one.
- Method
- Agentless discovery
- Exploitation
- None. Ever.
- Persistence
- None — probes are removable
- Scope
- Written, bounded, auditable
- Datasets
- Mirrored locally, never live-queried
- Raw data
- Stays in your environment
§ 05 · Deployment
Three boundaries, decided before the first scan.
Where the probe sits, where the control plane sits, and where the reference data sits are separate decisions — and all three are yours.
Control plane in your estate
The system that schedules the work and holds the findings runs inside the boundary you already control, so the raw scan data never leaves your environment.
Your infrastructure · your controls
Datasets mirrored locally
The vulnerability and end-of-life data every finding is matched against is mirrored locally rather than queried live, so correlating a target’s estate never discloses it to a third party.
No third-party lookups
§ 06 · Who it is for
Where the technical chapter has to hold up.
The questions asked at the end of a technical workstream are all questions of evidence. Each one is answered from the scan record rather than from an interview.
- Transaction advisory
- A repeatable technical workstream that produces the same artefacts on every mandate, with evidence a partner can sign off.
- Legal and regulatory counsel
- NIS2 and DORA exposure identified before it becomes a warranty discussion or a post-closing obligation.
- Corporate development and CIOs
- Integration cost and technical debt quantified while the price is still open, not discovered in the first quarter after closing.
| The question | What the scan produces |
|---|---|
| “What is actually running in there?” | Every reachable host with its open ports, detected services and versions, classified by asset type and grouped by site. |
| “What is exposed, and to whom?” | What is reachable from outside, what is reachable laterally, and which administrative interfaces are answering when they should not be. |
| “How much of it is out of support?” | Detected versions matched against a locally mirrored CVE dataset and end-of-life calendars — no live queries that would leak the target’s estate to a third party. |
| “What has to be untangled to separate it?” | Directory and entitlement structure mapped to show what must be untangled in a carve-out, and which accounts span both entities. |
| “Does this hold up to a regulator?” | Findings mapped to NIS2 and DORA obligations, so the technical chapter answers the questions the committee is required to ask. |
| “Can we still prove it in six months?” | Every finding carries the scan, host and timestamp that produced it — reproducible months later during negotiation or dispute. |
§ 07 · Next step
Run it against a live estate.
A briefing runs about forty minutes: a walkthrough of a real engagement, the evidence model, and how scope is agreed and bounded before anything is scanned.
Discovery and evidence collection · no exploitation, no persistence, no agents