stage 2 of the engagement
Map the attack surface before you start testing
Recon turns an authorised scope into the hosts, services and endpoints worth your time, so testing starts from a real inventory instead of a domain and a guess. It’s one stage of the engagement, not the product.
the platform
One source of truth, from recon to report.
Three capabilities sit around a single canonical findings database. Everything flows into it. Everything reports out of it.
01 · AUTOMATED RECON
Map the full attack surface.
We enumerate subdomains, DNS, open ports, web tech, TLS, cloud assets, and leaked credentials. When recon matches a known vulnerability, it opens a finding automatically.
Lite
Passive first. Runs in minutes.
Full
Deep and active. Runs in hours.
#subdomains
#DNS records
#open ports
#web tech
#TLS config
#cloud assets
#leaked creds
→auto-findings
Import from 202 security tools
Generated from our parser registry, not a marketing number. See the full list.
Burp Suite
Nuclei
OWASP ZAP
Nessus
Acunetix
Nmap
Nikto
Snyk
Trivy
TruffleHog Burp Suite Nuclei OWASP ZAP Nessus Acunetix Nmap Nikto Snyk Trivy TruffleHogThe rest of the engagement
Every stage writes to the same engagement record.
early access
Get Tandera before your next engagement.
Join the waitlist for early access. We are onboarding pentest teams in waves.
✓Priority onboarding for pentest teams.
✓A direct line to the people building it.
✓Early-access pricing, locked in.
No spam, no card. Unsubscribe anytime.