Institution-wide discovery
The first run: enumerate everything reachable under the institution's domains and find out how much of it is unrecognised.
Industries · Education
Nobody has a complete list of what your institution runs
A department stood up a project site in 2019. A research group runs its own server. A faculty subdomain points at infrastructure that was decommissioned two years ago. None of it went through central IT, and all of it is reachable.
Start by finding out what you actually have.
01
Industry overview
Education has an unusual governance problem: the institution is not really one organisation.
Departments and faculties operate with genuine autonomy, and that autonomy extends to technology. A research group procures its own infrastructure. A department launches a conference site. A faculty runs a legacy application because it is the only thing that does what they need. Central IT is frequently informed rather than consulted, and often not informed. The result is an estate assembled by dozens of independent decisions over decades — with a security team that is small, funded from a squeezed operational budget, and responsible for all of it.
The data is more varied than people assume. Student records, financial aid and payment information, health service data in institutions that run one, HR records, and research data that in some fields is genuinely valuable and in others is subject to grant conditions or export controls.
The user population also turns over almost completely every few years, by design, and includes a substantial cohort who are curious, technically capable, and on the inside of the network.
02
Security challenges
- R01
No reliable asset inventory
Decentralised procurement means the security team cannot enumerate its own estate from records. This is the foundational problem and everything else follows from it.
- R02
Orphaned and abandoned services
Sites and applications that outlived their owners, their projects and sometimes their departments. Unmaintained, unpatched, still answering.
- R03
Subdomain takeover risk
DNS records pointing at deprovisioned infrastructure. Education estates accumulate these faster than almost any other sector because nothing is ever formally decommissioned.
- R04
Legacy applications with no upgrade path
Departmental systems maintained by one person who left, running on frameworks past support.
- R05
Constrained budgets against enterprise-scale surfaces
A per-engagement consultancy model is simply unaffordable at this estate size, so most of it is never tested.
- R06
Research data with unusual requirements
Grant conditions, export controls and collaboration agreements that impose obligations most security programmes are not built around.
- R07
A large, capable, transient user population
With legitimate internal access and high turnover.
03
How AIPTx helps
- Stage 1
Start with discovery, because that is the actual problem
External Attack Surface ManagementReconnaissance enumerates subdomains, ports, services and endpoints across the domains you own, and fingerprints versions and frameworks. For an institution that has never had a complete inventory, this run alone tends to justify the exercise.
Discovered assets then receive assessment rather than just enumeration: service and version detection, CVE matching, TLS posture and default credentials on network ranges; application testing on discovered web and API surfaces. The output is not a list of things to worry about, it is a list with the exploitable ones marked.
- Stage 2
Find the abandoned before someone else does
Orphaned services show up as assets running outdated versions with known CVEs, and validated exploitation distinguishes the genuinely exposed from the merely old. Certificate and TLS posture checks surface the DNS and certificate hygiene issues that underpin takeover risk.
Validation is what separates the two lists a discovery tool usually hands over together. A decade-old conference microsite running an unpatched CMS and a decade-old microsite that is merely old look identical in an inventory. Only one of them is a way in, and the difference is whether the exploit ran.
- Stage 3
Cost that fits the estate
Assessment cost scales with assets rather than with consultant days, which is what makes covering forty departments a realistic proposition rather than a bid for funding that will not be granted.
That matters most for the departmental estate, where the sites are individually small and collectively the majority of the surface. A per-asset cost lets a research group's site be tested on the same schedule as the student portal, rather than being left out because it could never justify a day of consultancy on its own.
- Stage 4
Student portal and record systems tested properly
Web Application SecurityMulti-role authenticated testing across student, staff, faculty and administrative accounts, with cross-access attempted between them. A student reaching another student's record, grades or financial information is the finding that becomes an institutional incident.
- Stage 5
Internal assessment where it is authorised
The Docker-deployed agent covers internal IP ranges and CIDR blocks with outbound connectivity only. Useful on campus networks that were built for openness.
- Stage 6
Evidence a two-person team can act on
Every confirmed finding carries the exact request, the response, and a reproducible curl command, plus remediation guidance with vulnerable and secure code examples. When the team is small, triage cost is the binding constraint, and evidence is what removes it.
04Features & Solutions
Relevant features and solutions
Attack surface discovery
subdomain and asset enumeration, technology fingerprinting across a decentralised estate.
Network assessment
port, service and version detection, CVE matching, TLS posture, default credentials, across IP ranges and CIDR blocks.
Internal assessment via Docker-deployed agent, outbound only.
Deployed inside the campus network and reaching out, so nothing has to be opened inbound for it. Port, service and version detection, CVE matching, TLS posture and default credentials across the ranges you declare.
Multi-role authenticated testing
student, staff, faculty, administrator, with cross-access comparison.
Access control coverage
IDOR, horizontal and vertical privilege escalation.
Application and API testing
REST via OpenAPI or Swagger, GraphQL with introspection, gRPC with proto files.
Sensitive data and PII detection in responses, with verbose error monitoring.
Student records leak in passing more often than through the endpoint that was meant to return them: an identifier in an error page, a record quoted back in a stack trace.
Scan depth by need
Quick for breadth across many small sites, Standard for the systems that matter, Deep before an audit.
Compliance evidence
control mapping for GDPR, ISO 27001, SOC 2, NIST, CIS and PCI DSS, with gap analysis.
05
Benefits
- You find out what you actually run
- Which for most institutions is the single highest-value outcome available, and the prerequisite for everything else.
- The forgotten estate gets triaged
- Abandoned services are identified, assessed and ranked, so the small team can address the exposed ones rather than worrying about all of them.
- Coverage becomes affordable
- Cost scaling with assets rather than consultant days is what turns institution-wide assessment from a proposal into a programme.
- Student data exposure tested directly
- Cross-account access between student identities, tested rather than assumed.
- A small team gets leverage
- Confirmed findings arrive ready to act on, which is the difference between a backlog that moves and one that does not.
- Evidence for the budget conversation
- A demonstrated exploit against an orphaned departmental server is a more effective argument for governance change than a policy document.
06
Use cases
Orphaned service sweep
Identifying and assessing sites and applications with no current owner.
Student portal assessment
Multi-role testing across student, staff and administrative accounts with cross-access attempted.
Pre-enrolment readiness
Assessment before the intake period, when portal load and attention both peak.
Research infrastructure review
Assessing systems holding data subject to grant conditions or collaboration agreements.
Departmental onboarding
Assessing a departmentally-procured system before it is brought under central IT management.
FAQs
We do not know what we have. Where do we start?
With discovery. Reconnaissance enumerates subdomains, services and endpoints across the domains you own and fingerprints what responds. Most institutions find assets they did not know were reachable, and that inventory is what makes every subsequent decision possible.
Can this scale to our estate?
Cost scales with assets rather than consultant days, and Quick mode runs 15–30 minutes per target, which makes breadth across many small sites practical.
Is it affordable for a public institution?
Pricing is outside the scope of this page, but the model matters: because cost tracks assets rather than engagement days, assessing forty departments is not forty engagements.
Does it help with FERPA?
FERPA is not a documented control mapping. Findings map to GDPR, ISO 27001, SOC 2, NIST, CIS and PCI DSS. Technical testing evidence supports a student-records protection programme, but no testing tool delivers compliance with records legislation on its own.
Can we test departmental systems we do not control?
Only with authorisation. Scope is verified before anything runs, and testing systems you do not own or are not permitted to test is out of the question. In practice, discovery is what identifies departmental systems, and the governance conversation follows from the evidence.
What about our campus network?
Internal assessment via the Docker-deployed agent covers authorised internal ranges with outbound connectivity only: port and service detection, version detection, CVE matching, TLS posture and default credentials.
Will this disrupt teaching systems?
Destructive actions are off by default, the request rate is configurable, and out-of-scope paths are respected. Institutions typically avoid assessment windows during examinations and enrolment for operational rather than technical reasons.
How much staff time does this take to run?
Setup is measured in hours, not people. One person supplies the domain and, for authenticated testing, a set of credentials per role; discovery and testing run without supervision from there. The ongoing cost is triage, and that is the part the evidence is designed to remove: every confirmed finding arrives with the request, the response proving it worked and the fix, so the decision is whether to schedule the work rather than whether the finding is real.
The engine behind it
Find out what your institution actually runs
Start with discovery across your domains. Then test what matters, at a cost that scales with your estate rather than with consultant days.
Scope verified before any test runs · Destructive actions off by default
Security testing for other sectors
Same engine, different threat model, different auditor. Each page covers the systems, regulations and attack paths that sector actually lives with.
Financial Services
Payment flows, lending decisions, account servicing, open banking APIs — the logic that handles money is the logic attackers study hardest. It is also the logic no signature database describes.
ExploreHealthcare
Patient portals, scheduling systems, clinical APIs, payer integrations: all of it holds data that carries a lifetime of consequence if it leaks, and much of it runs on systems that cannot be taken offline for a test.
ExploreGovernment
Benefits portals, licensing systems, tax filing, records access — services that must be open to everyone by design, running on estates that were often built decades apart and connected later.
ExploreManufacturing
Almost nobody breaks into a plant by attacking a controller. They arrive through a corporate account, a supplier portal, an ERP integration or an exposed remote access service, and then walk into a network that was designed for reliability, not for containment.
ExploreRetail
The vulnerabilities that cost retailers money are rarely exotic. A discount that stacks when it should not. A price accepted from the client. A gift card balance that survives a concurrent request. A loyalty account reachable from another customer's session.
ExploreSaaS
Every enterprise deal arrives with a questionnaire, a SOC 2 request and someone technical asking when you last tested. Meanwhile you ship on Tuesday and again on Thursday, and the last pentest describes a product that has since changed twice.
ExploreTelecom
A single authorisation flaw in a subscriber portal is not one exposed account. At operator scale it is a data set — and the same flaw in a provisioning API is an operational one.
ExploreLegal
Clients do not retain a firm because of its document management system. They retain it on the assumption that what they share stays privileged — and increasingly they audit that assumption before instructing.
Explore