Discovery

Discovery is the information-gathering phase that opens almost every security assessment. Before touching a target, a team builds a picture of its domains, IP ranges, technologies, employees, and exposed services. The quality of this phase shapes everything that follows, since you cannot test what you never found.

Discovery splits into two modes. Passive discovery pulls from third-party sources, such as certificate logs, search engines, and public datasets, without sending traffic to the target. Active discovery queries the target directly through probes like port scans and DNS lookups, which is louder but more complete. Most of the data-gathering side draws on OSINT, the practice of mining openly available information.

In practice discovery means enumerating the footprint: subdomain enumeration to find hostnames, DNS enumeration to map records and resolve them to IPs, and asset discovery to tie everything into a single inventory.

Discovery suits automation well because it is repetitive and benefits from breadth. A workflow can run dozens of discovery tools in parallel, merge and deduplicate their output, and re-run on a schedule so the inventory tracks a surface that never stops changing.