Threat Surface Mapper
Map and visualize organizational threat surface.
Last reviewed by the Radiatus Cloud team
Need this done properly for your business?
Radiatus delivers secure cloud, DevOps & compliance engineering.
See everything an attacker could reach
An organisation’s threat surface is the sum of everything exposed to potential attack, and it is usually larger than anyone realises because it accumulates piecemeal. This tool maps and visualises the threat surface, so you can see the exposed points together and reason about which need the most protection.
Why mapping the surface matters
You cannot defend what you have not enumerated, and exposure accumulates invisibly: a service opened for a project, an integration added years ago, a forgotten subdomain. Mapping the surface brings these together into one picture, which reveals both the scale of exposure and the specific points that are most exposed or most valuable. Reducing the surface, closing what need not be open, is one of the most effective security moves, and it starts with seeing it.
Exposure made visible
Everything runs in your browser, so nothing you enter is uploaded and the tool works offline once the page has loaded. There is no account, no tracking of your choices, and no server involved in the result.
Related tools
- Data Collection Analysis — Analyze app description to infer data collection.
- Dark Pattern Detector — Scan UX text for manipulative patterns.
- AI Risk Disclosure — Generate disclosure text for AI features.
- Maturity Radar — Generate a radar chart of security maturity.
Frequently Asked Questions
What is a threat surface?
The sum of all points where an organisation is exposed to potential attack, from services and integrations to accounts and forgotten assets.
Why map it?
Because you cannot defend what you have not enumerated, and exposure accumulates invisibly. Mapping brings it into one picture that reveals scale and specific weak points.
How does mapping reduce risk?
By making it obvious what is exposed that need not be, so you can close unnecessary points. Reducing the surface is among the most effective security moves.
What tends to be forgotten?
Services opened for old projects, integrations added long ago, and forgotten subdomains or accounts, which stay exposed because nobody is tracking them.
Is my data uploaded?
No. The mapping runs entirely in your browser.
Privacy & Security
Mapping done locally.
About This Tool
This tool runs entirely in your browser. No data is sent to any server, ensuring complete privacy. Simply use the interface above to get started — no registration or login required.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.