You can build a useful attack surface inventory yourself from DNS records, certificate logs and your cloud accounts. Buy when the number of assets, the upkeep of data sources, or the need for ownership workflows outgrows scripts. The honest choice depends on who will maintain it in year two.
What would you build with?
A first version needs three kinds of input:
- Your own records. DNS zones, cloud account inventories, load balancers, registrars, domain lists.
- Public records. Certificate transparency logs, which list certificates issued for your domains, and public DNS data.
- Active checks. Connecting to discovered hosts to see what answers, using methods you are authorized to run against your own assets.
With these, a small script set can list hostnames, addresses, open web services and certificate expiry dates, and compare them with your register. For many companies that is a worthwhile week of work and reveals surprises quickly.
Where do home built tools struggle?
Coverage of unknown unknowns. Your records cannot find what is missing from your records. Finding assets that live in a vendor's account, a former employee's service or a subsidiary requires wider data and techniques.
Upkeep. Providers change formats and limits. Someone must fix the script.
Attribution. Linking an address to a company or team takes data and logic that is easy to get wrong.
Workflow. Findings need owners, tickets, deadlines and history. A script gives a list, not a process.
Safety. Active scanning against hosts you do not own can cause harm and legal trouble. A tool you build must restrict itself to authorized targets.
What does buying add?
Broader discovery sources, attribution logic, a workflow for owners and tickets, history and reporting, and a team that maintains it. What you give up: some control, plus recurring cost and the need to verify claims. Ask for a trial on your own domains and compare what it finds with your own scripts.
How do you decide?
| Question | Build if | Buy if |
|---|---|---|
| Size | Few domains, one or two cloud accounts | Many domains, subsidiaries, acquisitions |
| Change rate | Stable estate | Frequent new projects and teams |
| Staff | An engineer will own it for years | No one can promise upkeep |
| Workflow | Existing ticket system fits | Need owner assignment and history |
| Risk | Any single miss is tolerable | Misses carry high cost |
What is a sensible path?
Start by building the small version. It teaches you your estate and gives you a baseline. Then run a trial of a commercial tool against the same domains. Compare: what did it find that you did not, what did your script find that it missed, and how much of the follow up workflow does it handle? Decide from the comparison, not from a brochure.
What does a build cost you in practice?
Count the engineer time to write it, the time per month to keep it current, and the cost of the first missed asset. Compare with the commercial quote, including trial and integration effort. NIST SP 800-137 emphasizes ongoing monitoring programs, which means upkeep is part of the cost, not a footnote.
What should a commercial trial compare?
Run your script and the commercial tool against the same list of domains over the same two weeks. Compare assets found by each, assets found by only one, and false entries. Check how each handles attribution: does it say why it believes an asset is yours? Look at the workflow: can you assign an owner, open a ticket and see history? Record how many minutes of staff time each approach needed. These comparisons turn a vague preference into evidence you can defend.
Where Safeguard fits
Safeguard offers asset discovery with guardrails on discovered assets, and policies and gates at build, CI and release. It does not claim external attack surface management coverage and does not replace that kind of tool. The code and delivery controls apply once the owner of a discovered application is known.
What to do
- Build a small inventory from your own records and certificate logs.
- Limit active checks to assets you own and are authorized to test.
- Note what the script cannot see.
- Trial a commercial tool on the same domains.
- Compare findings, workflow and upkeep.
- Decide who maintains the choice in year two.
Quick check
Can certificate logs help find assets?
Yes. Certificate transparency logs list certificates issued for your domains, which can reveal hostnames you forgot. They do not show everything.
What makes homemade tools fail?
Usually upkeep and workflow, not discovery. Scripts decay, and a list without owners and tickets does not reduce risk.
Sources
- NIST SP 800-137, Information Security Continuous Monitoring
- RFC 9116, security.txt
- NIST Cybersecurity Framework 2.0
Last reviewed: 18 October 2026.
