What it looks at, and how.

Methods that reach out

These send traffic to your systems, so all of them are limited to assets you have confirmed you own or are authorized to test.

• 1
  Internet-facing discovery

  How: subdomain enumeration and DNS resolution across the domains you confirm, then TLS certificate inspection and port and service identification on what resolves.
  Needs: your domains and address ranges, confirmed as yours.
  Finds: assets nobody remembered were exposed, expired or mismatched certificates, deprecated TLS versions, administrative interfaces reachable from the Internet, and services whose version is known-vulnerable.

• 2
  Internal network discovery

  How: a probe on the network sweeps it with ARP and nmap, identifying hosts, open ports and service versions.
  Needs: a probe inside the network and the ranges you want swept.
  Finds: devices nobody inventoried, unexpected listening services, unsupported operating systems, and the internal reachability that decides whether an external foothold goes anywhere.

• 3
  Endpoint assessment

  How: an agent on the endpoint reports installed software and patch state; findings come from comparing versions against the vulnerability corpus, not from probing the machine.
  Needs: the agent installed.
  Finds: missing patches and vulnerable package versions, per machine, including on endpoints that never appear in a network scan because they were asleep or off-site.

• 4
  Fix verification

  How: after a fix, the specific service is re-checked — a TCP connect, a TLS negotiation, an HTTP header read, or a service banner. Only the check needed to answer the question, and only against authorized targets.
  Needs: nothing extra.
  Finds: whether the exposure is actually gone. A ticket being closed is not evidence; this is.

Methods that read configuration

These query a directory with credentials you supply. They read; they never write.

• 5
  Active Directory

  How: read-only LDAP queries against a domain controller.
  Needs: a read-only account, and your written authorization.
  Finds: unconstrained delegation, privileged accounts with service principal names, stale privileged accounts, weak domain password policy, privileged group nesting, and the paths those create toward domain control.

• 6
  Entra ID and Microsoft 365

  How: read-only Microsoft Graph queries. Every permission requested is a read permission — the platform cannot modify your directory, by design.
  Needs: an app registration and administrator consent. The exact permissions are shown before you grant them.
  Finds: privileged accounts without strong authentication, more Global Administrators than a tenant needs, guests holding directory roles, applications holding directory-wide write permission, and Conditional Access that is configured but not enforced.

Methods that only listen

These send nothing. They are how the platform learns what is really happening rather than what should theoretically be reachable.

• 7
  Honeypots

  How: decoy services you deploy deliberately, recording what connects, from where, and which credentials are tried.
  Needs: a honeypot deployed where you want the visibility.
  Finds: which services are being probed and by whom, and which credentials attackers are currently trying against you. Because a honeypot has no legitimate users, every connection to it is worth reading.

• 8
  NetFlow

  How: flow records exported by routers and firewalls you already run.
  Needs: flow export pointed at the collector.
  Finds: what actually talks to what. This is the difference between assuming a segment is isolated and having evidence, and it is what stops a finding on an unreachable host outranking one on a reachable one.

• 9
  Vulnerability and threat intelligence

  How: continuously synchronised CVE data, EPSS exploitation probability, the CISA Known Exploited Vulnerabilities catalog, and public exploit availability.
  Needs: nothing from you.
  Finds: which of your vulnerabilities are being exploited in the world right now, as opposed to which ones score highly in the abstract.

What it does with all of it

Collection is the cheap part. The reason for gathering these particular things is that together they answer a question no single one of them can.

What it does not do

A page that lists only capabilities is an advertisement. These are deliberate limits, and they are as much a part of the design as the checks above.

• —
  It does not exploit anything

  Validation is limited to safe checks — negotiate a protocol version, read a header, complete a handshake. Nothing tries to gain execution, and there is no destructive testing.

• —
  It does not scan what you have not authorized

  Targets are limited to domains and ranges confirmed as yours. Discovering an asset is not the same as being permitted to test it, and the platform keeps those separate.

• —
  It does not modify your directory

  Active Directory and Entra access are read-only. Remediation is described for a human to action, or executed through your own RMM under an approval mode you choose.

• —
  It does not run its own patches

  Exploit Hound is not an RMM. It submits named actions from a fixed catalog to the endpoint tool you already run; it cannot send a script of its own.

• —
  It does not claim what it could not check

  Where a permission was not granted or a licence is absent, the affected area is reported as unassessed rather than clean. An empty result and an unchecked area are different facts.