Left as the previous person in charge set it up
You do not know what is exposed
Is your company safe?
See your risk now, and what to do next.
Continuously checks your information assets exposed to the internet, such as websites and servers. It shows priorities and remediation methods for the vulnerabilities found, and you can also check the state after remediation.
Get started
Agentic CTEM — PentaTrail CTEM/ASM
The damage is already happening.
Why it mattersReports of data leaks due to unauthorized access are surging.
235
Aug
303
Sep
830
Octto the 16th
In just over half a month, about 2.7 times the entire previous month.
Ransomware damage, first half of 2026
Damage reports
123
Small and medium-sized businesses
approx.64%
79 / 123 damage reports
Intrusion via VPN devices
50%
18 / 36 valid answers on infection route
Is your website in a situation like this?
Let’s check it together.
How does it look to an attacker?No one in charge of systems, or
no time to deal with it
Checks and updates keep getting put off
You handle customer information
or inquiries
You want to check whether any weaknesses are visible from outside
What PentaTrail CTEM/ASM can do
1
Create an account
You can register with a secure passkey or a Google account.
If you start with an email address, you set up a passkey after confirming your email.
2
Register a domain
Starting from the registered domain, subdomains under it are also explored automatically, to identify the assets visible from outside.
Identify internet-facing assets and vulnerability candidates
Starting from your registered domains, PentaTrail continuously observes assets visible from the internet, such as subdomains, hosts, ports and services, and technology stacks. Based on what it observes, it lists known vulnerabilities that may apply.
Set priorities and review remediation methods
AI remediation guidance
Groups vulnerabilities by common remediation approach, such as those that can be addressed by updating the same product. This reduces the effort of researching each one individually, and lets you review the affected assets, impact, remediation steps, and temporary mitigations.
Attack paths
Visualizes the connections between external entry points and the affected assets. You can see the places that matter most for cutting off attack routes, and the risks expected to be resolved by remediation.
Set asset importance and owners, and move remediation forward
AI determines the business importance of assets from information such as products and services and web pages.
When you divide assets into groups and set an owner and members, remediation guidance that needs action within each area of responsibility is sent by email.
Make it clear who will respond, and move remediation forward while checking owners and progress.
See the notifications screen
Discuss remediation internally and with your maintenance provider
You can share the affected assets, the impact of vulnerabilities, and remediation methods in a report. Looking at the same information as people inside your company and your maintenance provider, you can discuss what to check, remediation methods, who does the work, and when.
CTEM/ASM remediation guidance report
A sample created in the same format as the actual report.
Open the sample PDFCheck the state after remediation
Observation continues after remediation, so you can check whether a vulnerability has been resolved or detected again.
Let your AI agent
handle the operations.
With MCP integration, you can operate PentaTrail from the AI agent you already use. You can let it check assets and vulnerabilities, check priorities, assign hosts to groups, and more, within the scope you approve.
See what MCP integration can do and how to connectExample requests to an AI agent
Let it check
“Summarize the high-priority issues
and the affected assets.”
Let it operate
“Assign this host to
the ‘Public Web’ group.”
Where should you start reviewing updates and settings?
First stepsWhat are ASM and CTEM?
ASM (Attack Surface Management) is the practice of continuously identifying your internet-facing assets and their vulnerabilities.
CTEM (Continuous Threat Exposure Management) includes that identification and continues through deciding priorities, remediating, and confirming the effect.
PentaTrail CTEM/ASM supports you from identifying assets and vulnerabilities through ASM, to decisions, remediation, and confirmation along the lines of CTEM.
Read more about ASM on our blogFrom identifying internet-facing assets to ongoing remediation.
ASM
$0
Check internet-facing assets and known vulnerability candidates.
Up to 1 domain and 5 users
Regular observation: once a month
CTEM
$215 / month (excl. tax)
From deciding priorities to reviewing remediation methods, sharing, and checking after remediation.
1 domain and 5 users included
Regular observation: daily
You can start identifying assets and vulnerability candidates for free. Priorities, remediation guidance, and more are included in CTEM. For pricing of additional domains and users, and comparisons, see the pricing page.
The reality of the attack surface, and where defenders stand now.
Japan External Attack Surface
How do Japanese companies’ websites and email settings look from outside? We organize the reality from continuous observation of public information.
Read the observation resultsWhere Defenders Stand Now
Even if AI can fix things, why does vulnerability response never end? Through conversations with people defending on the front line, we consider problems that technology alone cannot solve.
Read the conversationsRelated blog posts
What is ASM? Identifying assets visible from outsideMaterials to share and review internally
Download materials on the service and pricing — no sign-up required.
Two Japanese patents granted
Pentacon Research holds two Japanese patents: one for an assessment technology that integrates technical risk and business impact, and one for AI-based vulnerability verification and remediation text generation.
About the patentsFrequently asked questions
Does it affect our site or systems?
PentaTrail checks information and responses visible from the internet, such as DNS, web, and certificates. It does not install agents or change system settings. Because the checks involve access to your systems, we do not guarantee there is no load or impact at all.
What is the difference between free and paid?
With the free ASM, you can check internet-facing assets and known vulnerability candidates. With the paid CTEM, you can use priorities, AI remediation guidance, sharing through reports, checking after remediation, and more. See what is included and pricing.
Can I cancel or resume?
You can schedule a stop to the next renewal from the contract management screen. You can use the service until the end of the paid contract period, and there are no prorated refunds. After the end, you can resume paid use by signing up again. When moving to PentaTrail ASM, adjustments such as the number of users may be needed. For details, see the pricing page and the Terms of Service.
How is the information I enter handled?
We use account information, usage information, registered assets, observation results, and more to provide, operate, and improve the service and to ensure its security. Details, including purposes of use and outsourcing to external services, are published in the Privacy Policy.
Can the assessment prevent all threats?
It does not prevent all threats. PentaTrail continuously observes what can be checked from the internet and shows asset and vulnerability candidates. There may be misses or false detections, and some areas are out of scope, such as internal networks and features after login. Decisions on and implementation of remediation are made by you or your maintenance provider.
Who operates PentaTrail?
Pentacon Research, Inc. develops and operates it. Company information, the representative, business activities, and more are published on the company page.
What security measures does PentaTrail itself take?
In addition to access control based on zero-trust principles, we practice “shift left,” checking security from the early stages of development. We also build security checks into our CI/CD up to the release of changes, and keep checking continuously. We also protect communications and stored data, and separate data by contract. For details, see our approach to security.