What does OUTSIDE actually do?
OUTSIDE is an evidence-first external security control plane, not an ordinary scanner. It starts with a company domain, maps what the internet can observe, attributes known and possible shadow infrastructure, and keeps observation separate from inference. Guardian then detects change, Aegis guides an owned response, supported remediation is verified again from outside, Chronos preserves history, and evidence can flow into NIS2 and Agency workflows. It is defensive visibility software, not a penetration test.
I signed in. What should I do first?
Choose the organization you want to protect, start a paid plan or its 5-day trial, and open Account. Enter the first registrable domain you control. OUTSIDE maps the public surface and generates an exact ownership proof; copy the DNS TXT record or use the supported well-known web file. After verification, choose daily or weekly monitoring and activate Guardian. You do not need to find or upload security evidence yourself—Guardian creates the first evidence baseline and then explains changes, recommendations, and the next action.
How does the 5-day trial and billing work?
Single, Business, and Agency each support a full 5-day trial, available once per organization. Stripe requires a card at checkout but does not charge it that day. Unless an administrator cancels in billing management before the trial ends, Stripe automatically charges the selected monthly or annual price. Payment methods and cancellation are self-service; contact support before switching an existing subscription to another plan.
How does OUTSIDE help with NIS2?
Open NIS2 and begin with the guided scope assessment. OUTSIDE then maintains source-aware control records, risks, tasks, exceptions, policies, supplier assessments, continuity tests, training, access reviews, management reviews, and an Incident Center with Article 23 reporting stages. Relevant Guardian, Release Assurance, validation, vulnerability, identity, backup, and supplier evidence can be attached automatically, and an integrity-hashed audit package can be exported. OUTSIDE supports evidence and operations; it does not declare legal applicability, certify compliance, or replace legal advice.
What are Evidence Intelligence, Chronos, and Attacker View?
Evidence Intelligence keeps the source, observation time, confidence, supporting and contradicting evidence, gaps, and a SHA-256-sealed snapshot behind important conclusions. Chronos reconstructs and compares states that OUTSIDE actually recorded after monitoring began; it cannot invent internet history from before collection. Attacker View replays how the observed surface was revealed, while connected attack journeys distinguish observed steps from inference and possibility without exploitation.
Does OUTSIDE actively test or exploit my systems?
OUTSIDE never performs exploitation, credential attacks, brute force, or payload delivery. Domain verification alone does not authorize active testing. A separate organization administrator authorization must name the exact target and can be revoked. Supported findings can then receive a bounded DNS, TLS, or HTTP re-check; selected header and certificate checks may use an isolated Nuclei worker with a pinned two-template allowlist, signed requests, fixed arguments, and no user-supplied commands.
What can OUTSIDE change for me, and can it roll back?
Most recommendations remain guided and read-only. With an explicitly connected least-privilege Cloudflare token, an administrator can preview and approve DMARC monitor-mode DNS plus six bounded website settings: HTTPS redirect, minimum TLS 1.2, TLS 1.3, automatic HTTPS rewrites, Browser Integrity Check, and a 30-day verified HSTS policy. OUTSIDE reads the current value, records the previous value, refuses stale/conflicting writes, audits the action, and offers conflict-aware rollback. DMARC, HTTPS redirect, TLS 1.3, and HSTS include an external verification step; other provider read-back is not presented as end-to-end proof.
What does the Agency plan add for MSPs and MSSPs?
Agency adds an isolated multi-client workspace over the same security engine: owner-approved client linking, groups, portfolio posture and search, fleet operations, SLA workflows, analyst notes, invitations, client portals, branded and white-label reports, scoped API keys, billing export, and a NIS2 portfolio roll-up. Each client remains a separate organization and one client's data is never made reachable from another workspace.
Is scanning safe, and can I scan any domain?
The public snapshot uses passive, publicly available sources by default. Active checks, continuous monitoring, and remediation require an authenticated account and verified control of the target. Only scan domains you own or are authorized to assess. Domain owners can also use the published opt-out mechanism.
Which data sources does OUTSIDE use?
Core discovery uses public certificate-transparency, DNS, RDAP where available, HTTP, TLS, mail-security, and technology observations. Optional organization-owned integrations add passive DNS, breach intelligence, IP/domain reputation, non-web service exposure, AI explanations, and ownership attribution from AWS, Azure, Google Cloud, Microsoft 365, Google Workspace, GitHub, Vercel, Netlify, DigitalOcean, and Fastly. Provider limits or failures remain explicit incomplete evidence and never become a passing result.
Why do I need to verify a domain?
Verification proves that your organization controls the registrable root domain before OUTSIDE performs active observations or stores continuous history. One DNS TXT record covers the root and its subdomains; the supported web-file method is an alternative. OUTSIDE never receives DNS control. Keep the proof published so any future ownership recheck is seamless.
What is OUTSIDE Guardian?
After ownership verification and monitor activation, Guardian establishes an evidence baseline and compares scheduled observations over time. It detects new, returning, disappearing, and materially changed exposure; calculates Exposure Drift; maintains a living checklist and Exposure Inbox; assigns evidence-backed recommendations; routes grouped alerts; and sends a weekly executive digest. It explains what changed, why it matters, who owns the next action, and whether an external retest closed it—without claiming exploitation.
Can I connect my own provider and cloud accounts?
Yes. The integrations page can connect HIBP, SecurityTrails, Shodan, AbuseIPDB, GreyNoise, VirusTotal, Censys, OpenAI, AWS Route 53, Azure DNS, Google Cloud DNS, Microsoft 365, Google Workspace, GitHub Pages, Vercel, Netlify, DigitalOcean, and Fastly. These are read-only evidence, enrichment, or ownership-attribution connections. Credentials are verified server-side, encrypted, tenant-scoped, never shown again, and usage/failures are audited. Cloudflare is separate because its explicitly approved remediation actions can write; connecting it never authorizes arbitrary DNS, WAF, or access-policy changes.
Does AI decide what is a finding?
No. Discovery, findings, scores, and evidence are deterministic. Optional AI can explain an existing result in plainer language, but it cannot add assets, findings, or scores. Secrets and personal-data patterns are redacted before a model call, and a deterministic explanation remains available without AI.
How much does OUTSIDE cost?
Free Snapshot is €0 and provides one passive external snapshot, not continuous protection. Monthly pricing is Single €9.90, Business €29.90 and Agency €79.90. Annual billing costs 10 monthly payments: €99, €299 and €799 respectively. Every paid plan includes the same production-ready security engine and starts with one 5-day trial per organization. A card is required; Stripe charges the selected monthly or annual price after day 5 unless you cancel first.
What counts as one protected domain?
One registrable root domain, such as example.com, uses one slot. Its subdomains are included in that slot. A different registrable root uses another slot. Pending verification can reserve a slot temporarily; paused, archived, and removed domains do not consume active capacity.
Are all security capabilities included in every paid plan?
Yes. Single, Business, and Agency receive the same production-ready security engine, including Guardian, Chronos, Evidence, Digital Twin, ORIGIN, FORWARD, and supported Aegis remediation. A specific action still appears only when the Capability Registry confirms that the provider, target, permissions, verification, and rollback conditions are genuinely supported.
Is Agency really unlimited?
Agency has no fixed protected-domain slot limit and adds multi-client fleet operations. Fair use still applies to concurrency, provider rate limits, queue fairness, and abuse prevention so one workspace cannot degrade service for others.
Can I switch plans, and what happens when I downgrade?
Payment methods and cancellation are available in Stripe billing management. Plan switching is support-assisted at the moment. A downgrade is accepted only when active domain use fits the destination plan: pause or archive excess domains first. OUTSIDE preserves their history and never silently deletes protection records to force a downgrade.
Is Free Snapshot continuous monitoring?
No. Free Snapshot is one passive external assessment and product demonstration. Continuous Guardian monitoring, stored change history, connected remediation, and ongoing verification begin after target ownership is verified and a paid protected-domain plan is active.
How does OUTSIDE handle my data and credentials?
Customer records are tenant-scoped, provider credentials are encrypted, and production uses durable database storage with bounded retention controls. Public demos use synthetic data. OUTSIDE minimizes model inputs, avoids tenant and domain labels in product telemetry, and exposes documented export, revocation, retention, and offboarding procedures.