Skip to main content
OASM is an open-source platform for cybersecurity Attack Surface Management (ASM). It is built to help security teams identify, monitor, and manage internet-facing assets and potential security exposures across their digital infrastructure. The platform continuously discovers and monitors assets — root domains, IPs, and CIDR ranges — and turns them into an actionable picture of your external attack surface: what is exposed, which technologies run on it, where vulnerabilities were found, and how risk changes over time. OASM runs as a three-tier system: a Console web application for day-to-day operations, a Core engine that serves the business logic, and distributed Workers that execute security scanning tools. Data is stored in a managed database, with support for geographic lookups and Docker-based deployment.
This page introduces the platform’s capabilities. To get hands-on, follow the Deployment guide. For terminology and architecture, see Concepts.

​
Features

  • Asset Discovery & Management: Discover and manage internet-facing assets — domains, IPs, services, and CIDR ranges — with asset grouping and multi-workspace support.
  • Vulnerability Assessment: Scan for vulnerabilities and misconfigurations with severity ratings, AI-powered analysis, and dismissal reasons such as false positives, findings used in testing, or issues not going to be fixed.
  • Issue Tracking: Track findings as issues with Open or Closed states and threaded comments for remediation coordination.
  • Technology Detection: Identify technologies, services, and certificates running on discovered assets, including TLS monitoring.
  • Distributed Scanning Engine: High-performance distributed workers that can be scaled out for parallel scanning tasks.
  • Tool & Provider Integration: Extensible framework for integrating security scanning tools (subdomains, HTTP probe, port scanning, vulnerability scanning, screenshots) and third-party providers.
  • Workflow Automation: Automate discovery and scanning with workflow templates (domain discovery, IP address discovery, basic vulnerability scanning) and scheduled runs.
  • Job Registry: Track the lifecycle of every scan and automation run with Queued, Running, Completed, Failed, and Cancelled states.
  • AI Assistant Integration: Built-in AI chat assistant, plus an MCP server so external AI assistants can query asset data via natural language.
  • Real-time Monitoring & Notifications: Event-driven notifications — when a new asset is discovered, a new vulnerability is found, a vulnerability analysis finishes, someone is invited to a workspace, or a workspace is created — keep you informed of changes across your attack surface.
  • Search & Analytics: Search and filter asset data with analytics for risk trends and reporting, including a statistics dashboard.
  • Reporting: Generate Summary and Vulnerability reports with preview and export.
  • RBAC & Team Management: Role-based access control with Owner, Admin, and Read-only permission groups, plus custom groups, member invitations, and a full audit log.
  • Workspace Isolation & API Keys: Multi-workspace support with isolated attack surfaces and workspace-scoped, rotatable API keys.
  • Integrations: Connect Cloudflare, Slack, Telegram, and generic webhooks (with Jira integration coming soon).
  • Docker Deployment: One-command deployment with Docker Compose.

​
Getting Started

Deployment

Run OASM with Docker Compose from the oasm-docker repository.

Concepts

Understand core terminology: workspaces, targets, assets, and workers.