> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.method.security/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.method.security/_mcp/server. # Black Box External Assessment > Inventory validated paths to compromise with always-on, trusted autonomy. This is the first stage of the Continuous Challenge maturity ladder. This page covers how to start to build an inventory and risk assessment of your external attack surface. ![Automator overview tab showing 881 running Tasks across All Environments. The left panel lists scheduled Tasks like Cloud Enumerate, CMS Enumerate, Service Pentest, SaaS Discover, and DNS Discover with their cadence and next run time. The right panel shows an orbital visualization of upcoming runs grouped by frequency: Weekly, 1 hour, 30 min, 15 min, and Next Run.](/_fern-img/f2b3c52d3c09b1d63e1167e409ff3a5eee921eebf13b757bf477ac0265529bca.webp) Setting up Method to run these assessments will give you: * A live, continuously refreshed inventory of every domain, subdomain, IP, service, web application, and more reachable from the public web. * An inbox of Findings that a Finding Validation Agent has already validated, not raw scanner output. Confirmed risks land in the **Validated** tab. False positives, remediated findings, and over- or under-rated severities are sorted out before they hit your queue. * An outside-in view of your environment that mirrors how an adversary would target you. Same vantage point, same blind spots. No configuration time is required after setup, which takes only a few minutes. Scans are entirely external and require no internal, privileged access. Scans run on a schedule, Agents validate as Findings appear, and the only findings asking for your attention are ones that have already been validated by AI. --- ## Setup #### Set up an Environment An [Environment](/platform/core-platform/administration) is the unit Method scopes work to. It represents the network, domains, and infrastructure you want assessed. Environments typically map to an organization, business unit, or other logical grouping of owned assets. If you are setting Method up for the first time, the Welcome to Method onboarding wizard will guide you through the set up. Open the **Input data** step. You will see every Environment your organization already has. Click **Add another Environment** to create a new one. ![Welcome to Method onboarding wizard on the Input data step, showing a grid of existing Environments with a yellow arrow pointing at the Add another Environment button.](/_fern-img/5f4de9265ec5905d7db5d3ed6fa7e3fc42cddcb0d8e5ec69528920615362eda4.webp) Past onboarding, the same flow is one click away from the **lightning bolt** quick-action menu in the left sidebar. ![Start something new menu with a yellow arrow pointing at the Create a new Environment option.](/_fern-img/2792a74ea559af1ca04ef5b5133541ce2158d3cbef7d3f0014a2aeca5c15b4e2.webp) The Create New Environment form will ask you for Environment details to start: * **Environment name**: A short, recognizable name. This shows up everywhere the Environment is referenced: Findings, Operations, Reports. * **Network type**: **On-prem**, **Cloud**, or **Hybrid**, depending on your infrastructure. #### Add seed data Once you provide seed data, Method scans outward and discovers subdomains, services, web applications, SaaS surfaces, and related infrastructure. Under **Add a new Environment**, fill in: * **Organization Slugs**: Comma-separated organization identifiers Method uses to seed EASM discovery scopes. * **DNS Resolvers**: The resolvers Method uses for DNS enumeration. The default is `1.1.1.1:53`. * **Critical Domains and CIDR Ranges**: The seeds Method works outward from. Add FQDNs and IP ranges directly, or switch to CSV upload for bulk import. * **Begin scanning**: Toggle this on to kick off scans the moment the Environment is saved. ![Add a new Environment form showing fields for Environment name, network type, Organization Slugs, DNS Resolvers, Critical Domains, CIDR Ranges, and a Begin scanning toggle.](/_fern-img/eb5bec093cce4c2e26196a23970252458e2839c1861b1c59de4309461f6918f7.webp) For a full walkthrough of every Environment setting, including network type and tagging, see [Create a new Environment](/guides/platform-setup/create-a-new-environment). #### Configure scans To begin scanning, toggle **Begin scanning** during Environment creation. Method launches the Task automatically the moment seed data is saved. Method ships with a pre-built scan flow for external assessment: the **Bastion EASM Flow**. It is a Task that orchestrates every Tool involved in mapping an external footprint. DNS, CDN, and SaaS discovery feed into service and web discovery, which feed into deeper enumeration and recursive passes. ![Graph view of the Bastion EASM Flow Task in Automator, showing nodes for DNS Discover, CDN Discover, DNS Enumerate, SaaS Discover, recursive DNS Discover, Service Discover TCP, DNS Pentest, Service Discover UDP, Web Discover stages, and Service Enumerate.](/_fern-img/be77c511f475dca5e6797164722b0ddd15d49177c71f90fa979c24fc0a822cae.webp) For background on Tasks, schedules, and Task Runs, see [Automations](/platform/core-platform/automations). For a step-by-step walkthrough of running a Task yourself, see [Run a Task](/guides/automations/run-a-task). Once setup finishes, the wizard confirms the Environment is online and the first scan is in flight. ![Environment setup complete checklist showing completed steps for the Method tour, exploring existing data, specifying new data, creating environments, adding data, and starting new scans.](/_fern-img/e616efc584e3600116e07f344b7128bf5acaf4545f4eaedf7995f18f9fd1ca8c.webp) --- ## What Method does on each scan From here, Method runs the assessment on whatever cadence you set: daily, weekly, or another schedule that fits your environment. Every run does the same three things. ### Maps your environment Every Tool in the Bastion EASM Flow is run against your seed data and subsequent discoveries, and the output is a growing graph of [Objects](/platform/core-platform/objects) inside the Environment: domains, subdomains, IPs, services, web applications, SaaS surfaces, and the relationships between them. New Objects from each run join and expand the graph. Every Object is linked to its history, how it was discovered, and any associated Findings, detailed below. ### Scans Objects for Findings Every Object Method discovers is scanned for [Findings](/platform/core-platform/findings). These are the dozens of checks that look for exposures, misconfigurations, and vulnerabilities. They run against newly discovered Objects and against existing Objects on every subsequent scan. Method creates a Finding every time an Object matches a Finding definition. Each one carries severity (Critical, High, Medium, Low, or Info), a description of what it is and why it matters, a graph of the affected Objects, remediation guidance, and a history showing when it was first seen, last seen, and every observation between. ### Sends Findings to Agents for validation When auto-trigger Agents are enabled for a Finding type, the configured [Agent](/platform/core-platform/agents) launches when a new Finding of that type appears. The Agent probes the underlying Object the same way an analyst would. Agents follow rules of engagement defined in [Policies](/guides/agents/create-a-policy). Depending on what it finds, the Agent will: * **Validate** the Finding. Confirmed Findings move to the **Validated** tab with a green checkmark. * **Mark it as a false positive** if the exposure cannot be confirmed. * **Close** the Finding if it has already been remediated. * **Adjust severity** up or down based on what the investigation reveals. Findings that reach your triage queue have already been validated by an Agent. False-positive marks, closures, and severity changes are recorded with the Agent's reasoning attached for audit. > **Note** > > For the configuration walkthrough, see [Enable auto-running Finding Validation Agents](/guides/agents/enable-auto-running-finding-validation-agents). For background on > Agents and Policies, see [AI Agents](/platform/core-platform/agents). --- ## Day-to-day usage Scans run on a recurring schedule, populating the Findings app with new validated Findings. Use them like so: * **Triage validated Findings** in the [Findings app](/platform/core-platform/findings). The **Validated** tab holds Findings an Agent has already confirmed. Filter by severity, family, environment, or tag, then resolve, accept, or escalate. * **Explore the Object inventory** to understand what is in scope. Every domain, service, and web application Method finds lives here, with its relationships and history. New surfaces show up here first. * **Investigate live in [Operations](/platform/core-platform/operations)** when a Finding warrants a deeper look. Method seeds the Operation with the Finding context and underlying assets, so you land in Operator ready to work. Because the platform validates Findings as it discovers them, you spend your time on results that already carry a confirmed risk. --- ## Stop scans Use these controls when a scan needs to be cancelled, paused on a recurring basis, or turned off entirely for an Environment. * **Cancel a running scan.** Go to Automator, open Activity, find the running scan, and select **Cancel**. * **Disable an individual scheduled scan.** Go to Automator, then Activity, find the scan, and open the three dots under **Actions**. Select **Disable schedule** to stop that scan from running again. * **Disable all scans in an Environment.** Go to Automator, open **Manage Activity**, and select the Environment. This turns off every scheduled scan running against it. --- ## Next steps Once a Black Box External Assessment is running, the next stage of the Continuous Challenge maturity ladder is [Continuous External Challenge](/guides/best-practices/continuous-challenge/continuous-external-challenge). Method's Targeting workflow takes validated Findings through PoC and exploitation under Rules of Engagement you control, surfacing not just confirmed risks but the proven paths an adversary could leverage.