Cordon watches every asset you expose to the internet, proves which weaknesses an attacker can actually reach, and closes them with the team that owns them. Continuously.
Inside the perimeter
They start from the outside: DNS, certificates, buckets, a staging host someone forgot. Cordon maps your estate from that vantage point, proves what is reachable, and closes it first.
Watching the perimeters of
The demo estate, last 30 days
median, including weekends
median, owner notified in Slack
so nobody chases them
every one carries its proof
How it works
Three loops that never stop. Each one hands the next a smaller, truer list.
01
Cordon starts where an attacker would: public DNS, certificate logs, cloud accounts, app stores and job posts. It draws the perimeter around what it finds, including the hosts your inventory never heard of.
14 read-only connectors · first map in under an hour
02
Every weakness is tested the way it would be used: the request is sent, the token is tried, the role is assumed. A finding only exists if the step actually worked, and the proof travels with it.
No production data read · every step logged and replayable
03
The owning team gets one message with the proof and the cheapest fix. When the change ships, Cordon re-runs the same step within the hour and marks the finding closed, with a timestamp your auditor can keep.
Slack, Jira, Linear, GitHub · re-checked in 41 minutes on average
Live run
A replay of one hour on the demo estate. Each line is a step Cordon actually took, not a vulnerability that might matter. Filter it, pause it, read the proof.
cordon · demo-eu · replay 14:02 – 15:02 CET
4 reachable0 closed1 unreachable5 of 13 steps
Use cases
Cordon reads your cloud accounts and compares them with what the internet can see. The difference is where incidents start: a load balancer from a 2022 migration, a bucket with listing enabled, a region nobody uses any more.
We found 212 hosts we didn't know we had. Cordon pulled them out of certificate transparency logs in the first hour, before anyone had opened the integration docs.
The proof is what sold engineering. A finding arrives with the exact request that worked, not a severity score, so the argument about whether it matters never happens.
Our quarterly pentest used to be the first time we heard about staging. Now staging is closed before the pentester has logged in.
Pricing
Every plan includes every connector, unlimited users and the full proof history. You pay for the number of external assets Cordon watches.
Up to 2,000 external assets
€1,170/ month
billed annually, excl. VAT
Up to 20,000 external assets
€4,000/ month
billed annually, excl. VAT
Unlimited assets
Custom
annual contract
Field notes
Questions
Book a demo
Forty minutes with an engineer. We connect your public DNS during the call and walk through what Cordon finds, with proof. No slides.