fullhunt.io

What it is

FullHunt is positioned as an External Attack Surface Management (EASM) and attack surface intelligence platform, with two main product lines: an Enterprise ASM platform and an OEM API. It targets enterprise security teams, MSSPs, security vendors, and National CERTs. Its core goal is to discover internet-exposed assets, continuously monitor changes, and prioritize risk using vulnerability, exploit, and dark web intelligence.

Core capabilities and coverage

In terms of protection scope, FullHunt covers domains, subdomains, IPs, cloud services, open ports, technology stacks, TLS certificates, dark web credentials, lookalike domains, phishing infrastructure, passive DNS, TOR/OSINT research data, and more. Its vulnerability capabilities emphasize runtime validation. The site mentions 4,000+ security checks, with prioritization enhanced by EPSS, CISA KEV, and 100K+ public exploits. Deployment is mainly via a SaaS platform, REST API, and OEM white-label API; for National CERT use cases, on-premise deployment is also mentioned. For management and alerting, it supports real-time alerts for new assets, new services, new URLs, configuration drift, visual changes, and more, with delivery to SIEM, SOAR, Slack, and other systems.

Pricing and integrations

Pricing is not transparent. The official site only provides entry points such as a 14-day free trial of the enterprise platform, Request Demo, See Plans, and Request OEM Access. The trial package includes advanced asset discovery, continuous monitoring, URL crawling, vulnerability scanning, TLS tracking, SOC workflow integrations, and reporting, covering up to 400K organizational assets. Integration support is relatively strong, listing Splunk, Palo Alto Cortex XSOAR, FortiSOAR, Mindflow, Sumo Logic, Slack, Webhook, REST API, and MCP Server/Agentic AI.

Pros and cons

The main advantage is broad coverage, making it suitable for consolidating EASM, vulnerability intelligence, dark web monitoring, and automated reporting into one platform. Its API and white-label capabilities are friendly to security vendors and MSSPs. Multi-tenancy, audit logs, and customer reporting also fit managed service scenarios. The drawbacks are that the main content does not provide key information such as compliance certifications, data residency, pricing, payment methods, or SLA. Claims such as “zero false positives” should still be validated with trial data.

Best fit and access from China

FullHunt is better suited for mid-to-large enterprise SOCs, red teams, CISO teams, MSSPs, and ISVs that need to embed attack surface intelligence. National CERTs or government projects may want to pay attention to its national-scale enumeration, bulk data, and organization attribution capabilities. Access and payment availability from mainland China are not stated in the main content, so they should be considered unknown. If access, compliance, or procurement is restricted, alternatives worth evaluating include FOFA, ZoomEye, 360 Digital Security-related ASM products, or international options such as Censys ASM, Shodan, Tenable.asm, and Cortex Xpanse.