Exposure

Scans

Scheduled scans of the public domains you operate, alongside the provider scans Openlane ingests — every run dated and kept, so coverage is proof, not a claim.

Set the cadence once, keep the proof for good

Set a scan to run on the cadence you need and Openlane keeps the execution history — so when an auditor asks for proof that scanning happens, you have a dated record instead of a screenshot you took last week. Every scan tracks its schedule and next run.

Every run is dated and kept, not overwritten by the next one
The dated history SOC 2 CC7 and PCI DSS quarterly scans ask you to show

SCAN HISTORY · THEOPENLANE.IOWEEKLYScanning nowJUST NOWAug 318 FINDINGSJul 2721 FINDINGSJul 2026 FINDINGSEvery run is kept, so the trend is the evidence

Four scan types, one front door

Your attack surface is more than infrastructure — it's the domains you expose, the vendors you rely on, and the cloud accounts running your workloads. Bring every scan type under one roof and you get a single coverage picture across all of it, instead of four tools nobody reconciles.

Every scan records who ran it and who signed off
Vendor and provider scans pull third-party posture into the same view

Domain scantheopenlane.ioCOMPLETEDRAN BYopenlane_domain_scanIMPORTED INTO OPENLANEVENDORS0491315ASSETS1FINDINGS1Based on public data. Review before you rely on it.

Coverage you can prove, even when a run fails

A failed scan is still a fact about your coverage, so Openlane records it as failed instead of leaving a silent gap. Feed in the scanners you already run, and what you can show an auditor is an honest coverage picture — including the runs that didn't complete — not just a tidy log of the ones that happened to succeed.

Failed runs are recorded, not dropped — coverage stays honest
Each scan links out to the assets, vulnerabilities, and findings it produced

RECENT SCANSRUNNINGCompleted2H AGOASSETS124VULNS7FINDINGS18Failed5H AGORetried automatically

Automated Ingestion

The collection layer for Exposure

Scans feed everything else in Exposure. Each scan type runs on its own schedule and links out to registry assets, vulnerabilities, and findings — and every run is dated and kept, so the history an auditor asks for under SOC 2 CC7 or PCI DSS is already there.

Domain scans

Run checks against the public domains and endpoints you operate, on the schedule you set, with results recorded automatically for audit review.

Vulnerability scans

Scan infrastructure and application targets for weaknesses, with raw report attachments and execution timestamps kept alongside every run.

Vendor & provider scans

Document third-party security reviews during due diligence with vendor scans, and pull in results your cloud or service providers already produce with provider scans — both with the reviewer recorded on the scan.

Native Integrations

Ingest directly from
Google Cloud and AWS

Openlane records provider and vulnerability scans from Google Cloud Security Command Center, AWS Security Hub, and the other providers below on a recurring schedule, so your scan history reflects your current cloud posture — not a snapshot from last quarter's manual review.