IP / Host Exposure Audit
Live-scan a single IP address or hostname and see what is actually exposed on it right now. This is the opposite of a CVE Lookup: instead of looking up known CVEs for a product and version in a database, SysGlass contacts the target, scans its open ports, detects the real service and version on each, and reports the exposures it finds — the CVEs the running software is affected by (confirmed-exposed where a safe probe proved it, version-vulnerable where the banner matches a known-vulnerable release), DDoS-amplification vectors, exposed management/gateway services and admin panels, and TLS and HTTP-header weaknesses — each with an exact fix. Results stream in live as each check finishes. Only scan IPs and hosts you own or are authorised to test.
Reviewed by the SysGlass team · Updated July 21, 2026
Live-scan an IP or host and see what's actually exposed — open ports, services/versions, the CVEs it's affected by, amplification vectors, gateways, TLS/headers.
Look up the known CVEs for a product + version (or CPE) from the NVD database. No host is contacted — you research a piece of software.
Open CVE Lookup →Service scan — open ports + the service on each (TCP 1-1024 + smart UDP). The fast default.
Deep scan — thorough: high TCP ports + full UDP + safe behavioral CVE probes that confirm whether a service is truly exploitable (not just version-matched). Slower, run it for confirmed exposure.
What it checks
- Open ports on the target and the real service detected on each (service scan covers TCP 1-1024 plus smart UDP; a deep scan widens to high TCP ports and full UDP)
- The product and version behind each open port, identified from its banner/protocol response
- CVEs the running software is affected by — split into confirmed-exposed (a safe behavioural probe proved the service is genuinely exploitable) and version-vulnerable (the detected version matches a known-vulnerable release, shown with CVSS, severity and CISA KEV / known-exploited flags)
- DDoS-amplification vectors — services that can be abused as reflectors (open DNS resolver, NTP monlist, SNMP, SSDP, memcached, chargen and similar)
- Exposed gateways and management surfaces — admin panels, BMC/IPMI, databases, SSH and other services that should not be open to the internet
- TLS and HTTP security headers on the exposed web services, plus reverse DNS, ASN/network and blacklist reputation for the IP
- An overall exposure/health score with the top issues surfaced first and the exact fix for each
How to read the result
- CVE Lookup vs IP Exposure Audit: CVE Lookup answers 'what CVEs exist for product X version Y?' from the NVD database. This Exposure Audit answers 'what is actually exposed on this IP, and which CVEs is it affected by?' by scanning the host live. Use CVE Lookup to research a version; use this to audit a real machine.
- Service scan vs Deep scan: a service scan maps open ports and the service on each (TCP 1-1024 + smart UDP) — fast, the default. A deep scan is thorough: it adds high TCP ports, full UDP, and safe behavioural CVE probes that confirm whether a service is truly exploitable rather than just version-matched. Run the deep scan when you need confirmed exposure, not just a version guess.
- Confirmed-exposed CVEs are the priority: a safe probe demonstrated the service really is vulnerable on this host. Version-vulnerable CVEs are matched from the detected version and may be mitigated by backported patches — verify against your build.
- Known-exploited (CISA KEV) findings are loudest: these are vulnerabilities being actively exploited in the wild, so patch them first.
- Amplification vectors mean your host can be abused to attack others (and invites abuse reports) — close or restrict those services even if they aren't directly compromising you.
- Exposed gateways/admin panels and plaintext or unauthenticated services should usually be firewalled to trusted networks rather than left open to the whole internet.
- A clean result means nothing was reachable/exposed in the scanned range at scan time — it is not a guarantee; re-run after changes and run the deep scan for fuller coverage.
Frequently asked questions
How is this different from the CVE Lookup tool?
CVE Lookup is a database query: you enter a product and version (or a CPE) and it lists the CVEs recorded for it in NVD — no host is contacted. The IP / Host Exposure Audit is a live scan: you enter an IP or hostname and SysGlass connects to it, finds the open ports and services, and reports what is actually exposed plus the CVEs that running software is affected by. They are complementary — look up a version with CVE Lookup, audit a real machine with the Exposure Audit.
What's the difference between a service scan and a deep scan?
A service scan maps the open ports and identifies the service on each across TCP 1-1024 plus a smart set of UDP ports — it's the fast default. A deep scan is thorough: it also checks high TCP ports and full UDP, and runs safe behavioural CVE probes that confirm whether a service is genuinely exploitable instead of only matching on the version banner. Use the deep scan when you want confirmed exposure and the widest coverage; it takes longer.
What does confirmed-exposed mean versus version-vulnerable?
Version-vulnerable means the version SysGlass detected from the service banner matches a release with known CVEs — it's a strong signal but a backported patch could have fixed it without changing the version string. Confirmed-exposed means a safe, non-destructive behavioural probe actually demonstrated the vulnerability is present on this host, so it's the higher-confidence finding to act on first.
Can I scan a hostname, or only an IP?
Both. Enter an IP address to scan that exact host, or a hostname and SysGlass resolves it first. If the hostname sits behind a CDN/WAF, the name resolves to the edge — the scan will note that and, where it can, pivot to the real origin; otherwise use the Origin Exposure tool to find the origin IP and scan that directly.
What are DDoS-amplification vectors and why do they matter?
Some UDP services (open DNS resolvers, NTP monlist, SNMP, SSDP, memcached, chargen and others) reply with far more data than they receive, so attackers spoof a victim's address and use your server to flood them. If the scan flags an amplifier, your host can be conscripted into DDoS attacks and will attract abuse reports — restrict or disable the service even though it isn't compromising your own data.
Is it legal and safe to run this scan?
Only scan IPs and hosts you own or have explicit permission to test — scanning third-party systems without authorisation may be unlawful. The probes SysGlass runs are read-only and non-destructive (banner grabs and safe behavioural checks), but you remain responsible for having authorisation for the target you enter.