Oxygen Cloud Platform has released details of its internally developed VISORA EASM solution, created after the company found that no commercial External Attack Surface Management product met its depth, accuracy and flexibility needs.
Penetration tester and security specialist Мakar Rodenko explained that forgotten assets such as hastily deployed marketing landing pages and exposed test environments frequently fall outside inventory processes. Classic tools like SIEM and NGFW cannot detect these assets because they only monitor known log sources and gateways. EASM performs continuous “black-box” discovery of an organization’s entire external perimeter, identifying domains, subdomains, IP addresses, open ports, web applications, cloud buckets, instances and TLS certificates.
The team rejected a monolithic architecture in favor of microservices. Scanning nodes receive tasks via Apache Kafka, execute reconnaissance and fuzzing tools, normalize results and return them to a FastAPI backend backed by PostgreSQL. Additional nodes can be added independently to increase scan speed without duplicating the full stack. Three design principles were enforced: every scan must be reproducible, the scanner must never exploit vulnerabilities or access client data, and all vulnerability databases must operate offline-first with external APIs used only as fallback.
Asset discovery begins with passive subdomain enumeration and DNS resolution, followed by ASN mapping, port scanning and service identification. Multiple parallel tools feed a unified CPE list that is then matched against NVD, the Russian FSTEC BDU database and distribution-specific feeds for Debian, Ubuntu and Red Hat. A verification layer compares package versions and backports, returning one of four verdicts: confirmed, probably patched, distribution status unknown, or likely false positive.
Web application scanning first maps the attack surface through crawling, archived URLs and parameter brute-forcing, then runs detectors for OWASP Top 10 issues including XSS, SQL injection, SSTI, LFI, RCE, XXE and SSRF, plus misconfigurations, default panels, JavaScript secret leaks, subdomain takeovers, TLS weaknesses, GraphQL problems and CSRF. SQL injection findings receive additional boolean- and time-based confirmation probes that do not dump data or alter content.
Noise reduction includes deduplication across tools and a liveness filter that discards 404s, broken URLs and redirects to login pages. The React frontend built with TanStack Query presents assets as historical timelines, keeps filters and pagination in the URL, and opens detail cards without losing the user’s place in the table. Two scan frequencies are supported: lightweight daily checks and deeper weekly enumeration.
Development took approximately 1.5 years and included two major UI redesigns plus a full API and frontend rewrite to match the final microservices architecture. The solution never performs destructive actions and provides customers with a 14-day trial on the company website.
