Detectify launches IP Range Scanning to uncover hidden infrastructure before attackers do

50% of SSH exposure was found on non-standard ports; Detectify launched IP Range Scanning to continuously discover and monitor entire blocks of IP addresses. The feature automates identification of exposed infrastructure and forgotten assets to close critical visibility gaps and reduce hidden risk across IP ranges. This product launch strengthens Detectify's application-security tooling and could modestly improve its competitive position in the security market.

Analysis

This new class of continuous external discovery will shift spend from periodic penetration testing toward always-on telemetry that feeds asset inventories and automation workflows. Expect procurement cycles to compress from enterprise pilot to procurement in 3-9 months, but meaningful ARR recognition for platform vendors will materialize over 6-18 months as discovery becomes a gating input to cloud-security posture and remediation toolchains.

Second-order winners are platform vendors that can convert discovery signals into closed-loop remediation (identity, endpoint, CASB/CSPM) — they capture both discovery spend and downstream remediation ARR; legacy perimeter appliance vendors are at risk of 3-6% annual revenue erosion in their enterprise installed base as buyers reallocate budget to SaaS-based continuous controls over 2-4 years. Managed security providers and bug-bounty marketplaces win near-term professional services revenue, but face margin pressure as customers automate discovery→remediation.

Key risks: easy visibility increases noise — higher false-positive rates will drive vendor differentiation around signal-to-noise and automation (SOAR) integrations; if vendors under-deliver on remediation automation, churn will rise and multiple compression could follow within 12 months. Regulatory and legal pushback on aggressive mass scanning is a non-linear tail risk (weeks → months to crystallize) that could curtail some techniques or force product changes, temporarily slowing enterprise adoption.

Contrarian: the market is biased toward small pure-play EASM names being the winners; we think the more likely consolidation path benefits larger cloud/security platform vendors that bundle discovery as a feature, not a standalone TAM. That makes platform leaders preferable to speculative small-caps — the trade is about capture of cross-sell economics, not raw discovery volume alone.

Key Decisions for Investors

• Long PANW (Palo Alto Networks): 12–18 month horizon. Rationale: platform bundling of discovery → remediation should drive 20–40% upside if cross-sell accelerates; downside 15–25% if competition forces price pressure. Position size: 2–4% notional; consider buying calls to skew convexity.
• Pair trade — Long CRWD (CrowdStrike) / Short CHKP (Check Point): 9–12 month horizon. Rationale: endpoint/cloud-native vendors will capture incremental ARR from continuous discovery, while legacy firewall vendors face budget reallocation. Target asymmetric return ~+30% / -20%; run until quarterly results confirm higher EASM-led attach rates.
• Long ZS (Zscaler) or buy a 6–12 month call spread: 9–12 month horizon. Rationale: zero-trust tooling is the natural buyer for discovery outputs; expect 20–35% upside if adoption squeezes legacy VPN/edge spend. Use call spreads to limit premium decay risk.
• Tactical hedge: Buy short-dated protection (3–6 months) on pure-play small-cap EASM names if held — regulatory/scanning-backlash risk can produce quick drawdowns. Allocate 0.5–1% of portfolio to puts or protective collars during near-term rollout windows.