Automated cyber reconnaissance gathers information about an organization's visible technology and code without requiring a specialist to inspect each target manually. Authorized defenders can use it to discover unknown exposure, while attackers can use similar automation to search broadly for weaknesses.
Artificial intelligence can help interpret findings and decide what to examine next, making reconnaissance more persistent. Defensive programs need current asset inventories and monitoring so their own view of exposure is at least as complete as an external scan.
Why is persistent reconnaissance different from a one-time scan?
It can detect newly exposed services and software changes over time instead of providing only a snapshot that quickly becomes outdated.
How can organizations defend against automated reconnaissance?
Maintain an accurate asset inventory, reduce unnecessary exposure, patch known weaknesses and monitor continuously for changes and suspicious activity.
