Your surface

Your attack surface is everything an attacker could reach, and that is not only what faces the internet. It covers the external picture, the domains, subdomains, IP ranges and cloud resources your organisation exposes, and the people whose identities can be turned against you, and it reaches inward to your internal estate as well. Aether AI builds and maintains that map continuously, then uses it as the single foundation for both offensive emulation and continuous defence.

The internal picture matters as much as the external one, because a real intrusion rarely stops at the first thing it reaches. Aether AI's cloud integrations already paint part of that internal picture today, discovering the resources and accounts inside your cloud estate and tying them back to the surface. Support for on-prem environments and other internal agents is on the roadmap, so the map grows toward the full internal and external picture rather than stopping at what is exposed to the internet.

The map is not an inventory for its own sake. It is the thing an attacker studies first, and it is the thing Aether AI studies first too. Everything else, from validation of what a commodity attacker could exploit to autonomous frontier pentesting and the risk score you act on, is anchored to what lives on this map.

Why the map comes first

Attackers do not attack what they cannot find, and neither can Aether AI. Discovery is the gate: you cannot attack-emulate or defend an asset that has not been discovered. An unmapped subdomain, a forgotten cloud bucket, or an IP that fell out of an old asset spreadsheet is exactly where real breaches start, because nobody was watching it.

Because of this, discovery is treated as the entry point to every deeper capability. An asset has to be on the map before Aether AI can passively monitor it, validate what a conventional adversary could exploit against it, or point a frontier offensive agent at it. Getting the map right, and keeping it current, is what makes the rest trustworthy.

What Aether AI sees

Aether AI discovers assets from the seeds you give it: domains, subdomains, IPs, CIDRs, and keywords. From those seeds it expands the map and records what it finds as typed assets, and its cloud integrations bring in the resources and accounts inside your cloud estate. Asset types include domain, subdomain, IP, cloud resource, and person or identity, so the map spans external infrastructure, internal cloud estate, and the human identities tied to your organisation.

Every asset carries its provenance. At the moment an asset is ingested, Aether AI captures where it came from, including the provider and the account or scope id it belongs to. That provenance is what lets you trust the map: you can always trace an asset back to how it entered the surface, which matters when the same domain or resource could plausibly belong to more than one part of the business.

The result is a factual picture of your exposure that stays current as your organisation changes, rather than a point-in-time scan that is out of date the day after it runs.

How the pieces fit together

The surface section breaks into four connected topics. Discovery is how assets get onto the map. The relationship graph is a factual lens over that map, showing how assets connect to each other. Monitoring tiers control how much attention and validation each asset receives, and meter the cost of that work per asset. Enrichment is the passive intelligence, such as open-port inventory and technology fingerprinting, that deepens what Aether AI knows about each asset and feeds the validation layers above it.

Read in that order, they move from finding your surface, to understanding its shape, to deciding how hard to look at each part of it, to layering in what Aether AI can learn without touching anything.