App discovery: find the web apps nobody onboarded.
Start from your domain to find the web apps and APIs tied to it, including ones nobody onboarded. Confirm which ones are yours, then turn them into scan targets.
Web application discovery is the step before testing: building the list of web apps and APIs an organization actually runs, so security testing covers more than the apps someone remembered to register. NightVision app discovery starts from your domain, shows why each host is listed, and lets you confirm which ones are yours before any of them becomes a scan target.
You can only test the apps someone onboarded.
Target lists go stale quietly. Business teams launch campaign sites and portals, AI tools let people outside engineering ship working apps, acquisitions bring their own domains, and old environments stay online after the project ends. None of them reach the security team's list on their own, so none of them get tested.
How security teams cover apps built outside engineering →
How app discovery works
Start from your domain
Enter a domain you are authorized to assess.
See why each one is listed
Each host shows which sources found it, whether it answered, and what it appears to be.
Confirm what is yours
Mark the hosts that belong to you and set aside the ones that do not.
Turn them into targets
Confirmed apps become scan targets, ready to test.
Where the list comes from
Certificate transparency logs
Public logs of issued TLS certificates name hosts that were never linked from your main site.
DNS
Passive DNS history and live resolution show which names point somewhere today.
Web archives
Archived web history surfaces apps that were public once and may still answer.
Each source finds hosts the others miss, so the list is built from all of them.
Discovery is not a scan
Finding hosts uses public sources: certificate transparency logs, passive DNS, web archives and DNS resolution. NightVision then sends an ordinary HTTP request to each host it finds, and checks a small fixed set of well-known paths on live hosts. There is no fuzzing, no authentication attempt, no port scanning and no attack payload, and nothing is tested until you create a target. Run it only on domains you are authorized to assess.
From inventory to a tested app
A confirmed app needs nothing installed to be tested: a URL is enough to start. Add a recorded login and NightVision tests it fully authenticated. Where a repo exists, source intelligence maps its API routes from source code, so the API scan reaches routes a crawler would never click. AI endpoints get their own tests.
Available on Enterprise. We turn it on for your proof of concept.
App discovery questions, answered.
What is web application discovery?
Web application discovery builds the list of web apps and APIs an organization runs, starting from what is publicly observable about its domains. It answers the question a scanner cannot answer for itself: which applications should be tested at all.
Where does NightVision find the apps tied to my domain?
From public sources: certificate transparency logs, passive DNS, web archives and DNS resolution. Each host in the results shows which sources found it.
Does app discovery scan or attack my apps?
No. NightVision sends an ordinary HTTP request to each host it finds and checks a small fixed set of well-known paths on live hosts. There is no fuzzing, no authentication attempt, no port scanning and no attack payload. Nothing is tested until you create a target.
What if the list shows a host that is not ours?
Set it aside. You confirm which hosts belong to you, and only the hosts you confirm become scan targets.
Is app discovery in the free trial?
No. App discovery is available on Enterprise, and we turn it on for your proof of concept.
Find the apps nobody onboarded. Then test them.
Confirm which apps are yours, then test them with NightVision web app DAST.