Most breaches don't begin with a zero-day but with something ordinary like a forgotten server, an unmanaged network device, a service reachable across a segment that was supposed to be isolated. Internal scanning was supposed to catch exactly that but most scanners match a host's banner and version against a CVE list and flag everything potentially affected, so the few reachable exposures sit lost among thousands that were never exploitable.

That noise is expensive now that the window to respon

ProjectDiscovery Blog

ProjectDiscovery has launched Internal Network Scanning, a feature that deploys a lightweight agent (pd-agent) inside your network to discover and scan reachable hosts the way an unauthenticated attacker would. Unlike traditional credentialed scanners (Tenable, Qualys, Rapid7) that match banners against CVE lists and generate noisy unvalidated findings, this tool runs unauthenticated scans using the Nuclei detection engine and returns only confirmed, exploitable exposures with the request/response proof. The agent connects outbound only, requires no credentials or domain account, supports Linux/macOS/Windows via Docker/Kubernetes/systemd, and integrates with Kubernetes pod/service CIDRs. It complements existing scanners by covering unmanaged devices and forgotten servers, and pairs with Neo, ProjectDiscovery's AI security engineer, for deeper reasoning about authorization flaws and lateral movement paths.

Introducing Internal Network Scanning: see your network the way an attacker inside it would — ProjectDiscovery Blog