.%20TODO(brand):%20replace%20with%20the%20master%20vector%20from%20the%20brand%20files.%20--%3e%3cdefs%3e%3clinearGradient%20id='rudratic-mark'%20x1='0'%20y1='195'%20x2='0'%20y2='828'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20offset='0'%20stop-color='%235a0bd8'%20/%3e%3cstop%20offset='1'%20stop-color='%23a5157c'%20/%3e%3c/linearGradient%3e%3c/defs%3e%3cg%20fill='url(%23rudratic-mark)'%3e%3cpath%20d='M253%20448%20545%20195l60%2070-292%20252z'%20/%3e%3cpath%20d='M348%20558%20473%20450v200L348%20768z'%20/%3e%3cpath%20d='M523%20405%20640%20305l83%2097-141%20120%20153%20128-102%2087-110-97z'%20/%3e%3cpath%20d='m663%20763%2072-61v126z'%20/%3e%3c/g%3e%3c/svg%3e){kind=small}
SWOT RadarCyber asset attack surface management
SWOT Radar: Find every device.Keep one record of each.Know who can log in.
SWOT Radar finds the devices on your network without agents, keeps one accurate, live record for each, and shows which accounts can log in to it, and how an attacker could climb from one to the next.
- Discovery queues in parallel
- 13
- Endpoint agents
- 0
- Reachability recheck
- 10 s
- Risk score per entity
- 0–100
0 / 25 foundRecheck in 10 sSample network
Scanning…New since last import
- IP
- —
- MAC
- —
- Vendor
- —
- OS
- —
- Can log in
- —
The problem
A CMDB starts drifting the day it is filled in
Fed by manual entry and periodic imports, an inventory goes stale fast. Hosts that appear between imports stay invisible, decommissioned ones linger as active records, and nothing in the entry says which accounts can reach the machine it describes.
cmdb_export_last_quarter.csv Sample
Discover
Discovery that never stops, with no agent to install
Thirteen discovery queues run in parallel across your CIDR ranges, directories and clouds, over the protocols your network already speaks.
- Reachability is rechecked every ten seconds.
- Scans run on cron schedules, with retries and live queue depth in the console.
- ICMP sweepLive hosts across CIDR ranges
- TCP and UDP probesOpen ports and services
- ARPMAC addresses and vendors
- SNMP v1, v2c, v3Network gear and OIDs
- TLS and bannersHTTP headers, SSH and TLS banners, certificates
- SSHLinux users, sudo members, packages, services, cron
- WinRMWindows local admins, services, software, hotfixes
- LDAPAD computers, users, groups, GPOs and trusts
- Cloud APIsAWS EC2, RDS, IAM, EKS and S3; Azure, GCP, VMware
- Docker and KubernetesContainer endpoints, printers and OT protocols classified
Reconcile
One record per device, even when its address changes
Records are matched on MAC address before IP, so a host keeps its identity through a DHCP lease change, and its lifecycle (Active, Inactive or Removed) follows whether it can still be reached.
fin-ws-114Active
- System
- Windows 11 Enterprise
- MAC
- 3C:52:82:4A:19:C0 HP
- IP
- 10.20.8.114
- Environment
- Finance
- Endpoint
- EDR present
Sample host
fin-ws-114 · · duplicate
An import-fed CMDB would now hold two rows for this machine.
Access
Who can log in to it
Directory, local and cloud identities resolve into one model. For every host, SWOT Radar stores the local admins, the sudo and wheel members and the SSH users, and follows nested AD groups down to five levels.
Accounts that can log in Sample
- deploysudo
- ops-adminwheel
- backup_svcSSH user
- j.patelSSH user
Accounts that can log in Sample
- AdministratorLocal admin
- CORP\Server AdminsLocal admin
- svc_sccmLocal admin
Nested groups
- CORP\Server Admins
- CORP\IT Operations
- CORP\Helpdesk Tier 2
- CORP\Contractors
Nested groups traversed to five levels: everyone in Contractors can log in here.
Attack paths
The shortest way to your domain controller
SWOT Radar builds the graph of who can reach what, finds nested group chains and the shortest paths to a domain controller, and scores every entity from 0 to 100 on six weighted factors, each capped so no single one dominates.
hops to the domain controller
Sample graph. Names are illustrative.
Platform
Everything in one console
- 01
Asset Inventory
Filterable CMDB across hostname, IP, OS, device type, EDR state and source, with CSV export.
- 02
Infrastructure
Discovered hosts with ports, MAC and vendor, plus ping sweep and deep scan triggers.
- 03
Dashboard
Asset, directory, risk and alert counts, live on load.
- 04
Discovery Dashboard
Queue depth, jobs running and failed, and assets found since midnight.
- 05
Scan Scheduler
Cron schedules bound to a scan type, a target list and a stored credential.
- 06
Scan Jobs
Job status and configuration, down to the state of the job in its queue.
- 07
Worker Monitoring
Registered workers, heartbeat and the queues each is attached to.
- 08
Connectors
Stored AD, SSH, WinRM, AWS, Azure and VMware targets that drive deep scans.
- 09
Active Directory
Domains, group policies, password policy and domain controllers.
- 10
Identity
Users, groups and computers by source, each with the hosts it can reach.
- 11
Attack Paths
The graph, with critical paths and escalation chains beside it.
- 12
Risk Center
Scores by entity type and band, and on-demand reanalysis.
- Deployment
- Docker Compose, or native on Windows Server and Ubuntu Server.
- Integrations
- Active Directory, AWS, Azure, GCP and VMware.
- Access control
- Six role levels with inherited permissions, and a structured audit log of asset, session and identity events.
- Reporting
- Filter on OS, device type, environment, EDR state and source; export CSV, board reports and evidence views.
Maps to
- CIS Controls v8Controls 1 and 2: asset and software inventory
- ISO 27001:2022A.5.9 inventory of information assets
- NIST CSF 2.0Identify: asset management
- PCI DSS v4.0Requirement 12.5.1 system inventory
SWOT Radar’s inventory maps to these controls. Whether a control is met depends on your scope and assessor.
FAQ
SWOT Radar, answered
What is SWOT Radar?
SWOT Radar is cyber asset attack surface management. It discovers the devices on your network without agents, keeps one authoritative record for each, and maps which accounts can log in to every host, including through nested groups, so you can see attack paths to your domain controllers.
Does it need agents on our endpoints?
No. Collection is agentless, over ICMP, TCP, UDP, ARP, SNMP, SSH, WinRM, LDAP, TLS, Docker, Kubernetes and cloud APIs. Deep enumeration of Linux and Windows hosts uses stored SSH and WinRM credentials.
How is it different from a CMDB?
A CMDB is filled by manual entry and imports and drifts between them. SWOT Radar populates and reconciles its records continuously: it matches devices on MAC address before IP, rechecks reachability every ten seconds and stores who can log in to each machine.
Which environments does it cover?
On-premises networks across CIDR ranges, Active Directory over LDAP, AWS (EC2, RDS, IAM, EKS and S3), Azure, GCP and VMware, plus Docker and Kubernetes endpoints, printers and OT protocols.
How are risk and attack paths worked out?
Every entity is scored from 0 to 100 on six weighted factors, each capped. The graph follows nested group chains and finds the shortest privilege escalation paths to a domain controller.
How is it deployed?
With Docker Compose, or natively on Windows Server and Ubuntu Server. Scans run as thirteen queues on Redis with retries, cron schedules and worker heartbeats you can watch in the console.
See your own network the way an attacker would
Book a walk-through on your ranges, directory and clouds.