Automated vulnerability scans produce lists. CASP produces a prioritised outside-in picture with analyst accountability, authorisation, and a signed report. Mixing them buys either too little depth — or too much noise without a decision. For DACH companies the point is clarity before the next budget step, not more PDF volume.
An IT lead shows three scan PDFs with 600 findings. We take them as input, run CASP outside-in with DNS-TXT, and prioritise 12 points that are truly visible and business-relevant from outside. 80% of scan rows are noise or already known internally. The board report is 8 pages, not 80 — with a clear next-step list. Figures and names are anonymised; the flow matches typical engagements.
Tools are useful; they do not replace authorised judgement. We do not sell automation as deep CASP or CASP as an unlimited scan sub. That is intentional and part of the positioning.
This page’s job: Owns scan volume vs prioritised analysis only. Not pentest boundary and not pure surface-picture intent.
Comparison criteria for offers:
CASP: DNS-TXT/approval. Scan sub: often unclear.
CASP: analyst. Scan: often default severity.
CASP: yes. Scan: rare.
CASP: report. Scan: export.
Usually neither — pentest is separate.
CASP high-ticket with scope. Scan often subscription — different service.
Hundreds of findings without business context and without an outside-in story create tickets, not priority. Tools are useful — they do not replace authorised, manual judgement of what is truly visible and relevant from outside.
When scanner reports exist but nobody can narrate external exposure — or when a “scan subscription” replaced progress.
Scanners produce lists. CASP produces prioritised outside-in clarity with authorisation and analyst accountability. We do not sell automation as deep analysis — or deep analysis as an unlimited scan subscription.
Targeted automation plus manual judgement — not unlimited tool login branded as “CASP”.
Less noise, more decision — not 400 findings without a story.
Authorisation is a gate, not an optional checkbox in the T&Cs.
A handoff-ready deliverable, not a raw export only.
Typical boundaries:
CASP with prioritisation, signed report, authorisation
Using existing scan output as input when useful
Refusing to sell automation as pentest/CASP equivalent
Unlimited self-serve scan access as the CASP product
Finding guarantees from tool defaults
Active exploits inside CASP scope
If you want outside-in clarity instead of list spam: scope meeting. If you only want a scan subscription, we are the wrong shop.
Method boundaries first — no mixed CASP/pentest theatre.
Prioritised exposure clarity instead of unprocessed lists.
Human judgement, DNS-TXT, signed report — not tool defaults alone.
Focused hybrid baseline in defined day windows, not endless scan loops.
Approval and review — no tool farm inside your network for CASP.
Priority over the illusion of completeness from default scans.
What an attacker can see from outside — in language leaders understand.
Next steps to hardening, audit, or pentest — optional and separate.
Manual plus targeted automation, passive outside-in.
What matters first — not equal volume.
Handoff-ready for internal and external stakeholders.
Treat current reports as input, not a substitute.
Which scans/tools already run — and what is missing outside-in?
DNS-TXT and scope for CASP.
Passive analysis and judgement.
Report, next steps, optional active paths.
No. CASP frames outside-in exposure. Scanners can run in parallel.
No. Hybrid: targeted automation plus manual work and accountability.
Typically not for outside-in CASP — but domain authorisation yes.
Contact with domain and goal. See Pricing for orientation.
Yes. CASP frames outside-in; scanners can stay in internal/CI processes.
Not as the main product. What matters is prioritised exposure and next steps — not the loudest list.
CASP and penetration testing are often mixed — that wastes budget. We separate them: CASP is passive outside-in profiling with authorisation; a pentest is active, approved scope with RoE and PoCs. So you know what is worth doing first.
Open topic →External attack surface is what attackers and scanners can see without insider access. SHELL-AFFECT analyses it as CASP: passive, only with domain authorisation, with a signed report and prioritisation — so you know what matters first.
Open topic →An outside-in assessment at SHELL-AFFECT is CASP: a passive view of the externally visible attack surface, only after domain authorisation, with analyst accountability and a signed report. Orientation for leaders and IT before budget flows into active testing or unclear tool waves.
Open topic →Share current tools and goals — we say honestly whether CASP fixes the bottleneck.