Blog · Continuous monitoring

Continuous attack surface monitoring for bug bounty: why one-off recon leaves money on the table

You ran subfinder against the scope last month, triaged what came back, and moved on. The problem is that the scope you enumerated last month is not the scope that exists today — and the assets that appeared in between are exactly where the unclaimed bounties live.

Recon is a snapshot; scope is a moving target

A one-off scan captures the attack surface at a single moment. But a bug bounty program's surface is not static: new subdomains get provisioned, staging environments go live, an acquisition bolts on a new domain, a marketing team spins up a campaign host, an API version ships. Every one of those is a fresh, under-tested asset — and the hunter who sees it first has the cleanest shot at the bounty before the crowd arrives.

Continuous attack surface monitoring (ASM) is the practice of re-running discovery on a schedule and surfacing only what changed since last time: what is new, what moved, what disappeared. Instead of re-reading a full asset list every week and trying to spot the diff by eye, you get a feed of just the deltas — the five new subdomains, the port that opened, the endpoint that started responding.

Why "first to the new asset" is the whole game

Public program scopes ship new assets constantly, and the economics of bug bounty reward speed. Two hunters looking at the same program are not really competing on skill alone; they are competing on when they saw the asset. If a new subdomain goes live on Tuesday and you don't run recon again until the weekend, anyone monitoring continuously has had a four-day head start on the same target. Continuous monitoring turns "I happened to re-scan at the right time" into "I was notified the moment it appeared."

The part nobody talks about: attribution

Here is the question that decides whether any recon tool is worth keeping: which scan actually earned the money? Most hunters cannot answer it. They run several tools, findings pile up, a report eventually pays, and they have no idea which run, which asset, or which day surfaced the bug that got them paid.

Attribution closes that loop. When every finding is stamped with the scan run, the asset, the timestamp, and the source that surfaced it, a paid report traces cleanly back to the exact monitoring event that found it. That is not just satisfying — it is how you decide, at renewal time, which parts of your stack to keep paying for and which to cut. Recon without attribution is a cost you can't measure; recon with attribution is an investment you can.

The catch: continuous means always-on infrastructure

The obvious way to run continuous monitoring is to wire subfinder, nuclei, dnsx, and httpx together on a VPS with a cron job. It works — until it doesn't. Cron stacks break silently: a rate limit trips, a disk fills, a template set drifts out of date, and you find out weeks later when you finally check and realize you missed a window on fresh scope. The infrastructure that is supposed to save you time quietly starts costing it.

The alternative is to let the monitoring run on managed infrastructure so there is no VPS to babysit, no cron to maintain, no dedupe scripts to write. You define the targets that match your bounty scope, pick how often they sweep, and the platform handles discovery, detection, diffing, and alerting. This is the trade at the heart of ASMHunter vs a self-hosted recon stack: dollars for time, plus the diffing, alerting, and attribution a raw cron job doesn't have out of the box.

What good continuous ASM looks like in practice

Scope-shaped targets. You monitor the domains that are actually in a program's scope, so the system is built around authorized hunting rather than spraying the internet.
A real diff feed. New subdomains, ports, HTTP fingerprints, URLs, and findings land in one chronological stream, already deduplicated — not a fresh 500-line report you have to re-read.
Alerts where you already are. The moment the surface changes, you hear about it over Telegram or email, so coverage doesn't depend on you remembering to check.
Attribution per finding. Every result carries the scan, asset, and date, so a paid bounty ties back to the event that earned it.
Cadence that matches how you hunt. Weekly is a floor for casual coverage; daily-to-hourly is where serious public-program hunting lives, because serious assets move every day.

Where to start

You don't have to replace your methodology to get the benefit — continuous monitoring sits underneath it, catching the drift so your manual testing time goes to the assets that are actually new. The lowest-risk way to see whether it earns its place is to run it against your real scope alongside your existing stack and watch what it surfaces first.

ASMHunter runs continuous attack surface monitoring for bug bounty hunters — diff feed, alerts, and attribution, on managed infrastructure. Start free (no card), or see pricing and the MCP & API docs.