# Halo Security

> Halo Security is an External Attack Surface Management (EASM) and penetration testing company. The platform automatically discovers internet-facing assets, runs auto-configured continuous vulnerability scanning, and pairs findings with expert remediation guidance and manual penetration testing. Founded in 2013, SOC 2 Type II compliant, and a PCI DSS Approved Scanning Vendor (ASV).

Halo Security helps security teams gain visibility into their external attack surface across cloud, third-party, and organizational assets. Core capabilities: continuous asset discovery, risk-based vulnerability prioritization (including the CISA KEV catalog), and integrated manual penetration testing.

## Core Solutions

- [Attack Surface Management](https://www.halosecurity.com/attack-surface-management): Continuous discovery, inventory, and monitoring of internet-facing assets.
- [Penetration Testing](https://www.halosecurity.com/penetration-testing/): Manual penetration testing by a team holding OSCP, OSWA, PWPP, and CAPenX certifications.
- [External Vulnerability Management](https://www.halosecurity.com/external-vulnerability-management): Continuous external vulnerability scanning with risk-based prioritization.
- [Our Approach](https://www.halosecurity.com/approach): Methodology and philosophy behind Halo Security's EASM platform.
- [PCI Compliance](https://www.halosecurity.com/pci-compliance/): PCI DSS Approved Scanning Vendor services and ASV scanning.

## Penetration Testing Services

- [Web Application Penetration Testing](https://www.halosecurity.com/penetration-testing/web-application)
- [Mobile Application Penetration Testing](https://www.halosecurity.com/penetration-testing/mobile-application)
- [API Penetration Testing](https://www.halosecurity.com/penetration-testing/api)
- [External Network Penetration Testing](https://www.halosecurity.com/penetration-testing/external-network)
- [Internal Network Penetration Testing](https://www.halosecurity.com/penetration-testing/internal-network)
- [Wireless Penetration Testing](https://www.halosecurity.com/penetration-testing/wireless)
- [Compliance Penetration Testing](https://www.halosecurity.com/penetration-testing/compliance)
- [Social Engineering Testing](https://www.halosecurity.com/penetration-testing/social-engineering)
- [Red Teaming](https://www.halosecurity.com/penetration-testing/red-teaming)

## Platform Capabilities

- [Discovery Scanning](https://www.halosecurity.com/discovery-scanning): Agentless, continuous asset discovery.
- [Website Scanning](https://www.halosecurity.com/website-scanning): Monitoring of web-facing assets for client-side and content risks.
- [Server Scanning](https://www.halosecurity.com/server-scanning): Vulnerability scanning of server infrastructure.
- [Application Scanning](https://www.halosecurity.com/application-scanning): Application-layer vulnerability detection.
- [Technology Scanning](https://www.halosecurity.com/technology-scanning): Identifies software and technologies in use for CVE matching.
- [Firewall Scanning](https://www.halosecurity.com/firewall-scanning): Tests externally exposed firewall configurations.
- [Dark Web Monitoring](https://www.halosecurity.com/dark-web-monitoring): Monitors for exposed credentials and data.
- [Integrations](https://www.halosecurity.com/integrations/): Connects Halo Security with existing security tooling.

## Use Cases

- [Inventory Your Attack Surface](https://www.halosecurity.com/inventory-attack-surface)
- [Monitor Subsidiary Risk](https://www.halosecurity.com/monitor-subsidiaries)
- [Evaluate Mergers & Acquisitions](https://www.halosecurity.com/evaluate-mergers-acquisitions)
- [Assess Security Program Effectiveness](https://www.halosecurity.com/assess-security-program-effectiveness)
- [Prevent Subdomain Takeovers](https://www.halosecurity.com/prevent-subdomain-takeovers)

## Key Resources

- [Attack Surface Management 101](https://blog.halosecurity.com/attack-surface-management-101-everything-you-need-to-know-about-the-latest-approach-to-external-security/): Foundational explainer on EASM and external security.
- [A Practical Guide to Planning Your Next Penetration Test](https://blog.halosecurity.com/a-practical-guide-to-planning-your-next-penetration-test-in-2025/): Practitioner guidance on scoping and budgeting a pentest.
- [Why external vulnerability scanning is no longer sufficient on its own](https://blog.halosecurity.com/why-external-vulnerability-scanning-is-no-longer-sufficient-on-its-own/): Positioning on the limits of scanning alone.
- [Blog](https://blog.halosecurity.com): Ongoing research, threat advisories, and practitioner guidance.
- [Resource Hub](https://www.halosecurity.com/resources/): Guides, reports, and reference material.
- [Free Site Scan Tool](https://www.sitescan.com): Free external scanning tool.

## Company

- [About Us](https://www.halosecurity.com/company/): Company background, founded 2013, woman-owned, user-funded.
- [Customers](https://www.halosecurity.com/customers): Customer list and case material.
- [Contact](https://www.halosecurity.com/contact)

## Optional

- [Trust Center](https://trust.halosecurity.com): Security and compliance documentation.
- [Documentation](https://docs.halosecurity.com): Product documentation.
- [Get a Demo](https://meet.halosecurity.com/attack-surface-management-demo)
- [Free Trial](https://meet.halosecurity.com/free-asm-trial)