Architecture and scan lifecycle

This lesson shows how the parts of Orizon fit together and what happens, step by step, when you start an external scan.

Summary

Everything starts with your Orizon account: one sign-in takes you into RECON, and your Orizon profile is also where you manage your company, team and billing. RECON is the app where you start scans and read the results. Inside the network, Scout does the work: a probe installed on a Linux machine. Meccanica Adda, for example, runs one at its Treviglio plant and one in Rovato.

Each probe asks RECON for work and sends back its results: the connection always starts from inside your network.

Chapters

Key points

• Single sign-on. RECON signs you in with your Orizon account: no separate user is needed.
• Probes connect outbound. Scout regularly checks in with RECON and receives the scans to run in the reply. You do not open any inbound port.
• External scans and Cyber Tokens. When you start an external scan, RECON checks and deducts the Cyber Token balance of your Orizon account. The balance belongs to the account, not to a probe.
• Internal scans and licences. Probes have a licence: before every internal scan, RECON checks with your account that it is active. Internal scans do not use Cyber Tokens.
• Where you pay. Token bundles, licences, payment methods and invoices live in your Orizon profile, on the Billing tab.

The path of an external scan

1. You start from a domain, for example meccanicaadda.it, plus company details such as sector and size.
2. RECON searches public sources for subdomains of the main domain.
3. It resolves the names through DNS and links them to server addresses.
4. Port scanning finds the services that answer from the internet.
5. Technology detection identifies software and versions; RECON also checks TLS certificates and email security (SPF, DKIM, DMARC, DNSSEC).
6. The versions found are checked against vulnerability databases, confirming that each version really falls inside the affected range.
7. Using the company details, RECON assesses NIS 2 obligations and industry risk.
8. Finally it builds the attack surface map and makes the results and reports available.

Transcript

The full transcript of the video (in Italian) is in the player's Transcript tab.

Related articles