Attack surface monitoring · Verified remediation

Find what's exposed.
Prove it's closed.

ProvenClosed watches everything your company exposes to the internet, re-checks every fix, and issues a signed certificate your auditor or customer can verify on their own machine — without trusting us.

Start free See how the proof works

Free for one domainNo agents, no cardData stays in India

ProvenClosed

Remediation attestation

Exposed service: postgres on port 5432

Verified fixedVERIFIED

Resource: db.example.com
Last seen present: 12 Sep 2026, 09:14 UTC
Observed absent: 19 Sep 2026, 06:02 UTC
Since then: Watched — no regression
Coverage: Looked at 4 of 4 hosts

DSSE · RS256 · issuer provenclosed.com

~/audit

$ python verify.py certificate.html
  ProvenClosed ATTESTATION

  Signature ........ VALID     DSSE, RS256
  Issuer ........... TRUSTED   https://provenclosed.com
  Transparency ..... VALID     Sigstore Rekor
  Attestation ...... VERIFIED  production
  Verification ..... VALID     outcome=absent
  Coverage ......... COMPLETE

  RESULT  STATE: VERIFIED

Illustrative example with made-up data. The certificate layout and the verifier's output format are the real ones, shortened.

Fits the way you already work

GitHub IssuesAWS, read-onlySigned webhooksExports & API

The gap

Every tool finds exposures. None of them proves the fix.

Security teams do not lack findings. They lack a way to show — to an auditor, a customer's security review, or themselves — that a finding is actually gone, and stayed gone.

“It's marked fixed in the ticket.”

A status is a claim, not evidence. Somebody closed it; nothing checked that the port is shut or the bucket is private.

“Can you send the retest?”

Auditors and enterprise buyers ask for dated proof that a fix held — checked independently of whoever made it.

“That was true at the last VAPT.”

An annual test is a snapshot. New subdomains, open ports and cloud rules appear the week after it ends.

How it works

From exposed to proven closed, in four steps.

Prove it's yours

Add one DNS TXT record. Until you do, a domain gets only a passive baseline from public records — nothing is sent to it. Ownership is re-checked, not trusted forever.

Watch what's exposed

Subdomains, open ports, TLS, security headers, known vulnerabilities and your AWS posture — re-scanned on your schedule, with a record of what changed since last time.

Fix what matters first

A short, ordered list instead of a long one — with the exact command where a fix is one command. Hand a finding to GitHub Issues without copying it anywhere.

Prove it's closed

Only a later scan can mark a finding fixed. Then ProvenClosed keeps watching for it to come back, and signs a certificate of exactly what it observed.

The benchmark

Measured on a testbed where we set the answers.

68 of 68

Planted faults raised. Every weakness we put in the testbed came back as a finding, and every one was closed by a rescan after repair.

0 of 29

Decoy checks raised. Twenty-nine checks had to stay silent on clean and look-alike machines, including AWS's own documentation key and a site answering 200 on every path. All of them did.

3 of 3

False-fix traps held. The flaw stayed and the machine hid it. The finding stayed open.

The whole benchmark, and what it does not prove

Go deeper

Everything else, one page each.

What it watches

Asset discovery, exposed services, TLS and security headers, 100 reviewed vulnerability templates, AWS posture, lookalike domains, leaked secrets and AI exposure.

Attack surface monitoring