Inside Autobahn’s Asset Discovery Engine

Somewhere on the internet, there’s probably a server with your company’s name on it that nobody on your team remembers setting up.

It might be a landing page from an old campaign. A staging environment someone spun up for a client demo. A domain that came with an acquisition and never made it into the inventory. Nobody is patching it, nobody is monitoring it, and nobody is scanning it. But it’s still online, and it still leads back to you.

Ask most IT leaders how many internet-facing assets their company has, and you’ll get a confident number. Ask how they know, and the answer gets less certain.

That gap matters because attackers don’t start with your asset inventory. They start with discovery: mapping everything they can find that connects to your organization. The assets you’ve forgotten are often the first ones they reach, and the least defended when they get there.

At Autobahn Security, we wanted to find those assets before anyone else does. So Chris, our Security Engineer, built our asset discovery engine. Starting from little more than a company’s name and main domain, it searches the internet for assets that may belong to a customer, presents them to the customer to confirm, and adds the confirmed ones to their external scans.

We sat down with Chris to talk about why he built it, how it tells real assets apart from look-alikes, and the kind of find that still makes the work worth it.

What made you decide to build it? Was there a specific moment?

It wasn’t one dramatic moment. It built up over time. When I joined, we had a pile of individual scripts for pulling external assets, scattered all over the place. I’d write a new one without realizing one that did the same thing already existed. And with different authors, every script had its own output format, so merging the results was a project in itself.

The scarier story is from before my time. The team used to do this manually: googling and checking domains one by one, for every asset, for a single client. Once you’ve heard that, building something systematic stops feeling optional.

In simple terms, how does the engine find assets that might belong to a customer?

We start with the basics, the company’s name and its main domain, and branch outward from there. The engine pulls together a mix of public signals:

• Domain registration records
• DNS information, like where a domain’s mail servers and nameservers point
• Certificate data
• Business and company registries
• Search results
• Services that map domain redirects and ownership links, to trace which domains lead back to the same organization

No single source is trusted on its own. It’s about triangulating from several directions at once and seeing where they agree.

How does it tell a customer’s asset apart from someone else’s?

Every candidate gets a confidence level based on how many independent signals point to the same conclusion, and how strong each one is. A shared mail server is far more convincing than a name showing up in a search result.

False positives are the real challenge, and the more interesting part of the work. The most common trap is a shared name. Plenty of unrelated people and businesses around the world share a company’s name, and that alone can produce far more noise than signal. Other recurring traps: a company that was sold years ago but still appears under old records, or a partial stake or joint venture, which isn’t the same as owning something outright.

We handle this in layers. Automated cross-checking makes sure no signal is trusted in isolation. A human review happens before anything reaches a customer. And the customer has the final say on what’s actually theirs before it’s added to active scanning.

What was the hardest technical problem to solve?

Tuning the scoring around common names. A company with a distinctive brand name is relatively easy: almost everything that matches really is theirs. A company whose name is also a common surname or an everyday word is a completely different problem. One review can turn up dozens of candidates where only a handful are actually connected. The rest belong to unrelated people and businesses that happen to share the name.

Getting the scoring to work for both cases, without burying the easy ones in false positives or being so strict that it misses the real but less obvious matches, took a lot of iteration.

Why does discovering external assets matter? How does it connect to the rest of the platform, like Scanner or the Hackability Score?

An asset that isn’t known can’t be scanned, and an asset that isn’t scanned can’t show up in the Hackability Score. So a blind spot in discovery becomes a blind spot in the whole picture of a company’s security posture.

That’s why the two are connected. Discovery finds the candidates, the customer confirms which ones are theirs, and only then do they flow into the active scan scope that Scanner works from. Discovery is the step that decides what the rest of the platform is allowed to look at.

What happens after the engine finds something?

Nothing gets added to a customer’s scan scope silently. Candidates go through a review pass first, where we check them against the false-positive traps I mentioned and verify anything uncertain by hand.

What’s left becomes a short, specific list: here’s what we found that looks like yours but isn’t being scanned yet. That list goes to the customer through their Autobahn contacts in Sales and Customer Success, framed as a question for them to confirm, not a change we’ve already made. Once they confirm, those assets are added to their active scan scope.

What did you enjoy most about building this?

Finding the assets nobody expected to still be there. Something old or buried that looks like a long shot, and it turns out to really be the customer’s. Especially when it’s some flaky old site running ancient PHP. You just get a gut feeling the scanner’s going to find something critical on it.

Every organization has assets it has lost track of. The only question is who finds them first. Want to see what’s out there with your name on it? Get in touch with our team to learn how asset discovery fits into your external scanning.