Exposure management
Continuous discovery and ownership for every asset across the five strata, with change tracking that tells you what appeared, what moved and what quietly opened up.
assets under continuous discovery in the demo tenant
What exposure management actually does
Continuous discovery
Registrars, certificate transparency, cloud control planes, API gateways, identity providers and endpoint fleets, swept on a schedule you set.
Ownership resolution
Every asset gets a proposed owning team from tags, repository history and deploy identity. A human confirms it once, then it sticks.
Change ledger
A dated record of every asset that appeared, changed origin, gained a public route or lost its owner.
Shadow surface
Assets that resolve to your organisation but were never registered in your CMDB, flagged separately so they cannot hide in the totals.
See it working on demo data
- Discovery runs on registrars, certificate transparency, cloud control planes, identity providers and endpoint APIs.
- Every asset carries a proposed owner from the day it appears, confirmed once by a human.
- The change ledger records what appeared, what moved and what quietly gained a public route.
| Stratum | Owner | |||||
|---|---|---|---|---|---|---|
| partners.northfleet.io | Domains & DNS | Edge | Platform Web | critical | 4 | 2024-11-03 |
| nfg-invoice-archiveCrown jewel | Cloud resources | Core | Finance Systems | critical | 3 | 2023-02-19 |
| svc-datalake-ingest | Identities | Identity | Data Platform | critical | 2 | 2023-08-27 |
| legacy-edi.northfleet.io | Services | Edge | Integration | critical | 7 | 2021-11-19 |
| api.northfleet.io/v2/consignments | APIs | Gateway | Freight Platform | high | 6 | 2024-04-08 |
| staging.tenders.northfleet.io | Domains & DNS | Edge | Commercial | high | 5 | 2025-06-14 |
| nfg-prod-eks-freight | Cloud resources | Workload | Freight Platform | high | 9 | 2023-01-11 |
| vpn-ams-02.northfleet.io | Endpoints | Gateway | Network Ops | high | 3 | 2022-09-30 |
| nfg-customer-pii-euCrown jewel | Cloud resources | Core | Data Platform | high | 2 | 2022-05-16 |
| ci-runner-fleet-07 | Endpoints | Workload | Developer Experience | high | 4 | 2024-07-05 |
| depot-scada-rtd-12 | Endpoints | Workload | Facilities | high | 2 | 2022-08-08 |
| supplier-docs.northfleet.io | Domains & DNS | Edge | Procurement | high | 4 | 2025-01-30 |
| crew-scheduling.northfleet.io | Services | Workload | People Ops | medium | 2 | 2024-01-22 |
| nfg-secrets-prodCrown jewel | Cloud resources | Core | Platform Security | medium | 1 | 2023-04-04 |
| api.northfleet.io/internal/pricing | APIs | Gateway | Commercial | medium | 3 | 2025-02-27 |
| svc-github-deploy | Identities | Identity | Developer Experience | medium | 2 | 2024-03-13 |
| nfg-analytics-lake | Cloud resources | Workload | Data Platform | medium | 4 | 2023-10-01 |
| sso.northfleet.io | Services | Identity | Identity | medium | 2 | 2021-07-14 |
| mail-relay-rot-03 | Endpoints | Gateway | Network Ops | medium | 3 | 2022-02-11 |
| nfg-prod-rds-freightCrown jewel | Cloud resources | Core | Freight Platform | medium | 2 | 2022-03-25 |
| a.rehman@northfleet.io | Identities | Identity | Security | low | 0 | 2021-03-02 |
| careers.northfleet.io | Domains & DNS | Edge | People Ops | low | 1 | 2024-09-12 |
| api.northfleet.io/v1/tracking | APIs | Gateway | Freight Platform | low | 1 | 2022-12-06 |
| nfg-backup-vault-euCrown jewel | Cloud resources | Core | Infrastructure | low | 0 | 2023-06-21 |
Cloud control planes are polled every 15 minutes, DNS and certificate transparency continuously, and endpoint and identity sources hourly. You can force a sweep at any time.
They move to a retired state with the date they stopped resolving, and they stop counting toward your plan. History is kept so you can answer questions about them later.
Yes. A CMDB import seeds ownership and is reconciled against discovery, so you can see exactly where the two disagree.
Put exposure management against your own estate
A four-week proof of value connects one cloud account, your DNS and your identity provider, and ends with a written readout. Lodemark stays read-only throughout.
Illustrative product data. Nothing on this site performs a live scan.