Open Asm

OASM is an open source, self hosted attack surface management platform. It helps security teams discover, monitor and secure their own internet facing assets, and it adds AI agents that analyze each finding and suggest remediation steps. The platform keeps a continuously updated inventory of IP addresses, ports, services and technologies. Scanning covers subdomain discovery, port scanning, HTTP probing, vulnerability and misconfiguration checks, URL discovery, CMS checks and visual capture, built on open source scanners. Findings are tracked with severity ratings, risk analysis and remediation guidance, and technology detection fingerprints the frameworks and platforms on each asset. Assets can be organized into groups with their own tool settings and schedules, such as daily scans for production and weekly scans for staging. A horizontally scalable worker fleet distributes scan jobs and tolerates faults. A live dashboard shows statistics and notifications. Integrations include Slack, Telegram, AWS, GCP, Cloudflare, Vercel, GitHub and GitLab, with Jira ticketing described as coming. Scanning tools can be installed platform wide or per workspace, with third party providers and their API keys managed from the console. OASM is released under the GPL 3.0 license and deploys with Docker. The site publishes no pricing.