Know your Surface.

RECON is a cloud-based vulnerability scanner and attack surface management tool by Ironate. It detects vulnerabilities in networks, web applications and infrastructure: automated, continuous and with AI-powered analysis.

Yes. RECON was designed from the ground up as an MSP platform: full multi-tenancy, white-labeling, tenant-specific dashboards, centralized management and asset-based billing. You manage all customers from a single portal.

RECON gateways are lightweight VMs that are deployed in customer networks. They perform internal scans and transmit results to the cloud platform in encrypted form. Available as preconfigured images for KVM/Proxmox, VMware and Hyper-V.

RECON is billed per asset and month. The entry price is CHF 3.00/asset/month. From 50 assets the price drops to CHF 2.00, from 100 to CHF 1.00. High volumes from 1,000 assets start at CHF 0.50/asset/month. Full feature set from the very first asset, no feature gating.

CVEs, web vulnerabilities, misconfigurations, exposed credentials, SSL/TLS weaknesses, missing security headers and much more, across hosts, web applications, APIs and DNS. The scan engine is updated continuously.

Yes. The RECON platform runs entirely in the cloud, no local server operation required. For internal network scans, optional gateway VMs are deployed in the customer network and communicate with the cloud in encrypted form.

Immediately. Since RECON is cloud-hosted, you can start external scans right after creating your account. For internal scans you deploy a gateway VM; setup typically takes less than 30 minutes.

Each finding receives a risk score from 0–100, calculated from three factors: the technical severity (CVSS, EPSS exploit probability, CISA KEV status), the criticality of the affected asset (Low/Medium/High/Critical) and the exposure (public-facing vs. internal). This shows you at a glance what needs to be fixed first, not just by CVSS, but by actual business risk.

RECON offers signed outbound webhooks (HMAC-SHA256) for Slack, Microsoft Teams, Jira (including 2-way sync for ticket linking), ServiceNow and generic JSON endpoints. For authentication, OIDC and SAML are supported via Authlib (Microsoft Entra, Keycloak, Google Workspace). A flexible alert rule engine with AND/OR conditions enables precise triggers on severity, status, host patterns or CVE ID. For critical findings, incidents can be created automatically in the connected ticketing or SOAR system.

Yes. RECON implements GDPR Art. 17 (right to erasure) with tenant-wide data deletion, Art. 20 (data portability) via a built-in self-service endpoint and automatic retention with a configurable retention period (default 12 months). Sensitive configuration data is stored encrypted. Every action is recorded in the audit log with user, IP address and timestamp.

The integrated AI analyst is provider-agnostic: you choose which AI model processes your data, including locally operated models without any cloud transmission. The assistant runs real queries on your scan data (finding search, severity distribution, top-N rankings, trend analyses) and delivers context-aware prioritization and remediation recommendations. Tenant isolation is guaranteed; MSP admins can optionally analyze across tenants.

HIBS (Host-Intelligence & Brand-Surveillance) is the brand protection component of RECON. It continuously monitors domain permutations, homoglyphs and TLD variants of your brand name. On new matches, DNS, HTTP/HTTPS, TLS certificates, screenshots and tech stack are checked automatically. For detected phishing domains, a structured takedown workflow starts with an evidence package PDF (SHA-256 secured) and prepared abuse notification letters.

Black Kite works exclusively with OSINT: it performs no authorized scans in the customer network and therefore cannot see internal vulnerabilities. RECON combines authorized internal scans (via gateway VM) with external ASM and cloud inventory in one platform. Unlike Tenable and Qualys, RECON is MSP-native from the ground up: true multi-tenancy, white-label and tenant-specific billing are core features, not add-ons. CH/EU data residency without the US CLOUD Act is structurally impossible with any US vendor.

Yes, AWS and Azure are already live in production, each with more than 20 resource types (VMs, storage, databases, Kubernetes, IAM, Key Vaults and more). GCP support follows as the third cloud provider. The inventory runs without an agent directly via the cloud APIs and shows your customers' entire cloud attack surface at a glance.

Attack Path Analysis models how an attacker could advance through your infrastructure from an exposed service to your most critical assets (crown jewels). To do this, RECON connects hosts, vulnerabilities, ports, container images, DNS records and cloud resources into an asset graph and calculates prioritized attack paths with an overall risk score. This tells you which vulnerabilities actually enable a complete attack path, and what needs to be patched first. Feature in development, Phase D.

The planned compliance engine automatically checks your cloud configuration against CIS benchmarks (AWS, Azure, GCP, Kubernetes) and maps the results to regulatory frameworks: NIST CSF v2.0, PCI DSS v4.0, ISO 27001:2022, the revised Swiss Data Protection Act (revDSG CH-2023) and GDPR Art. 32. Each framework delivers a score (0–100), per-control drilldown, exception management with expiry dates and PDF export for audits.

Yes, planned for Phase D. RECON will inventory Microsoft 365 (users incl. MFA status, app registrations, conditional access policies, Defender alerts), Google Workspace (users, OAuth apps, Alert Center), Salesforce (users, connected apps, permissions) and Okta (users, groups, policies). The sweep runs automatically every 6 hours and reveals forgotten admin accounts, missing MFA and excessive OAuth permissions.