Your suppliers' exposure, without scanning anyone.
Your company depends on dozens of sites it does not control: a supplier's portal, a payment page, a SaaS tool, a partner's shop. When one of them runs outdated software, your people are the ones who sign in to it. Your browsers can already tell you which ones.
In short
- Every time your people open a site, the site announces part of its software: the web server, the language, the content management system and its plugins, the JavaScript libraries.
- ByteMantle collects only what those normal visits show, and the console matches each reported version with known vulnerabilities, the ones exploited in the wild and end-of-support dates.
- No scanner touches anyone's site. Nothing is collected until your organisation turns it on.
- The result is a decision aid — whom to ask, what to check first — not a verdict.
The browser already knows
A website describes itself in every answer it sends: response headers name the web server and sometimes its version, a "generator" tag names the content management system, WordPress pages list the plugins and themes they load with their versions, and the addresses of JavaScript libraries often carry the version in the file name. Some servers even show their version on their default error pages while hiding it everywhere else.
Your people's browsers receive all of this anyway, every time they work with a supplier or a SaaS tool. ByteMantle reads it during those normal visits — no extra request, no probe, no scan.
What the console does with it
- Matches versions with what is known. Each reported version is compared with NVD and OSV advisories, CISA's catalogue of vulnerabilities known to be exploited, the EPSS likelihood of exploitation and public end-of-support dates.
- Tells you whom it concerns. For every site, how many of your people opened it recently, so you know which suppliers matter most in practice.
- Answers new advisories quickly. When a new vulnerability is published, you can check which sites your people use report an affected version, without running anything new.
- Separates your own, your suppliers' and your customers' sites. Declare the domains once; each group gets an exposure score and its trend, and critical suppliers are ranked by how much your people really use them.
- Prepares the paperwork. Export a register of your ICT third parties (CSV or JSON) as input for NIS2 and DORA, and hand a supplier a clean PDF of what to fix.
Careful by design
The console says "reported version", "possible vulnerabilities" and "patch level unknown" — never "vulnerable". A Linux distribution can fix an old version without changing its number, and a CDN or a firewall can hide or rewrite the real one. A version that could not be compared with the advisories is shown as not assessed, never as clean.
Use it to decide whom to ask and what to check first. The supplier is the one who can confirm.
What it does not do
- It does not scan, probe or log in to anyone's site.
- It does not see what a site does not show: hidden versions stay hidden.
- It is off by default. Your organisation turns it on in its policy (Enterprise plan).
Questions people ask
Is this the same as an external attack-surface scan?
No. An attack-surface scanner sends its own requests to a target. ByteMantle only reads what your people's browsers already received during their work, so nobody's site sees any extra traffic.
Can our suppliers tell that we look at their software?
No. There is nothing to notice: the information comes from ordinary visits your people make anyway.
Which sources are used for vulnerabilities?
NVD, OSV, the CISA Known Exploited Vulnerabilities catalogue, FIRST EPSS and public end-of-support dates. The console shows when each source last updated.
Can we get this data into our own tools?
Today you see it in the console, in scheduled reports and in the register export. We are working on bringing it into the Read API as well.
Stop these attacks before anything runs.
Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it.