What is runZero?

View as Markdown

runZero

runZero is an attack surface and exposure management platform that helps you see everything on your network, from managed IT systems to unmanaged OT, IoT, cloud, mobile, and remote assets. It combines high-speed active scanning, passive discovery, and API integrations into one continuously updated inventory.

You can run runZero as a hosted service (SaaS) or on-premise. The platform includes one or more Consoles, distributed Explorers that run as lightweight services at your points of presence, and a command-line tool for offline collection and automation. You can work in the web interface, automate through the API, and, on self-hosted deployments, manage operations from the command line.

Data sources

Live inventory

  • Assets: runZero tracks all assets across the environment: cloud, mobile, endpoint, server, OT, IoT, and everything in between. It correlates and merges assets across data sources into a multi-perspective snapshot of all organization resources. The asset inventory supports deep search, configurable columns, and simple export.

  • Services: runZero tracks every network service it identifies through active scans, passive discovery, and integrations (where applicable). The services inventory simplifies exposure management tasks and supports deep search and exports.

  • Screenshots: runZero takes a screenshot of each exposed web service included in active scans. The screenshot inventory lets security teams inspect unknown devices and services by eye.

  • Software: runZero identifies network-exposed software and imports software records from API integrations. Use the resulting software inventory to find specific packages and versions across the environment.

  • Vulnerabilities: runZero reports vulnerabilities based on identified exposures and imports vulnerability data from API integrations. The vulnerability inventory comes in two forms: a detailed per-asset inventory and a grouped view for investigating specific issues.

  • Certificates: runZero identifies SSL/TLS certificates, including expired and soon-to-expire ones. The certificate inventory includes all relevant metadata, such as issuer, expiration date, and certificate chain.

  • Wireless: Active scans also enumerate wireless access points within range of the Explorer running the task. The wireless inventory includes the BSSID, SSID, encryption settings, and signal strength.

  • Users and Groups: runZero imports user and group information from directory services, including Active Directory, Azure Active Directory (Entra ID), and Google Workspace. Search the user and group inventories for accounts with specific attributes, such as expired passwords and excessive group permissions.

Reports

runZero’s reports cover everything from layer-2 topology maps to outliers and asset risk. Beyond the pre-defined reports, most attributes of an asset or service can become a grouped report with a single click. For deeper customization, the runZero Export API produces CSV and JSON(L) output with arbitrary search filters, which can feed analytics platforms like Tableau and PowerBI.

Monitoring and alerts

runZero can alert on changes to the inventory, on new results for custom search queries, and on any of dozens of system-level events. Alerts can be delivered in-product, by email, or to a webhook destination, including Slack channels. Alongside alerts, rules, and custom queries, you can define goals and custom dashboard widgets to track progress toward a specific outcome.

To put runZero to work, sign up for an account and follow the getting started guide.

Updated