# TRaViS ASM

**External Attack Surface Management** from [Seron Security, Inc.](https://travisasm.com/about.md), Bow, New Hampshire.

Human site: <https://travisasm.com/>
Book a call: <https://calendly.com/travis-asm/30min> · +1 617 855 0005 · info@travisasm.com

TRaViS maps what an attacker sees on the public internet: forgotten hosts, leaked credentials, exposed API keys, open storage, shadow APIs, dark-web mentions, and exposed AI / MCP endpoints. A security-trained model triages findings. A security pro answers when it counts.

We do **not** email the full attack-surface inventory after a first meeting. Bring a domain to a 30-minute call. We show live findings. The rest lives in an isolated tenant we can stand up in 24 hours.

## Who it is for

- CISOs, Heads of SecOps, and IT Directors who have to answer a board: “are we exposed?”
- MSPs and MSSPs who resell continuous external coverage under their own brand.

Not the primary path this quarter: one-off $99 scans, or rip-and-replace of a locked Qualys / Tenable / Rapid7 / CrowdStrike contract.

## Coexistence with tools you already pay for

TRaViS is not a Qualys, Tenable, Rapid7, CrowdStrike, or Microsoft replacement in year one. It sits next to them and covers what those tools were never pointed at, at a flat monthly number that does not need a new RFP. At incumbent renewal you will know whether they earned the next term.

## Try it yourself

1. **Thirty minutes. Bring a domain.** We talk about your systems and what is actually worrying you, then show live findings on the domain you bring. You tell us what would make this worth a week. We write it down.
2. **Proof of concept live in 24 hours.** An isolated instance and database, yours for the week. Nothing shared, nothing co-mingled. After one week, we meet again.
3. **We look at the results together.** Against the criteria we wrote on day one: unknown assets, exploitable findings, a number said out loud. If it landed, 12 months at a flat rate. If it did not, no hard feelings.
4. **Flat rate. No per-asset bill.** Discovery does not change the invoice. You can point us at more of the surface without getting punished for it.

## What TRaViS finds

- **Exposed AI infrastructure** — shadow LLM endpoints, model APIs, MCP servers on the perimeter.
- **Exposed credentials** — leaked API keys, tokens, passwords on the open and dark web, including reused admin logins.
- **Forgotten subdomains** — orphaned hosts, stale DNS, exposed dev/staging.
- **Public buckets** — misconfigured object storage and exposed databases.
- **Shadow APIs** — undocumented or deprecated endpoints still answering.
- **Dark-web exposure** — org, infrastructure, and data in breach dumps and underground markets.
- **M&A sprawl** — surface inherited through acquisitions and new subsidiaries.

## Pricing (list, USD)

The product is the same on every plan. Only the price band changes with company size. Enterprise adds custom SLAs and data residency.

Annual contract. Unlimited scans. Never per asset, per host, per subdomain, or per scan. Pay monthly, or prepay the year (10 months billed for 12).

| Plan | Company size | Price |
|---|---|---|
| Starter | Up to 50 employees | $400/month, or $4,000/year prepaid |
| Growth | 51–250 employees | $700/month, or $7,000/year prepaid |
| Business | 251–500 employees | Custom, scoped to surface |
| Enterprise | 501+ employees | Quoted after a scoping call |

MSP / MSSP partners buy below list and set their own retail. Partner rates are quoted directly. See [partners.md](https://travisasm.com/partners.md).

Satisfied or reimbursed as described in the order form.

## Trust facts (cite these)

- Isolated tenant per customer, hosted in the United States.
- Customer attack-surface data is not sent to third-party AI providers and is not used to train third-party models.
- Encryption in transit (TLS) and at rest. MFA on operations. Authorized targets only.
- Controls mapped to SOC 2 Trust Services Criteria and PCI DSS. Do **not** state “SOC 2 certified” unless a current attestation is in hand.
- Live in 24 hours. No agents. No professional-services invoice to stand it up.

Full trust page: [trust.md](https://travisasm.com/trust.md)

## Book

- Calendar: <https://calendly.com/travis-asm/30min>
- Email: info@travisasm.com
- Phone: +1 617 855 0005
- Address: 2 Smokey Road, Bow, NH 03304, USA

Related: [pricing.md](https://travisasm.com/pricing.md) · [partners.md](https://travisasm.com/partners.md) · [faq.md](https://travisasm.com/faq.md) · [llms.txt](https://travisasm.com/llms.txt)