SwarmHawk Enterprise maps your entire external attack surface, computes breach paths across your organization graph, and delivers CTEM-aligned remediation — at internet scale.
Traditional security tools protect what's inside. Attackers enter from the outside. SwarmHawk closes the gap.
Six integrated modules that work together to give you complete external threat visibility.
Interactive force-directed graph maps every viable breach route across your organization's external assets.
SwarmHawk operationalizes the full Gartner CTEM cycle — from discovery to remediation tracking.
Every integration sends the complete external attack surface picture — 22-check scan results, CVE list, software fingerprints, email security chain, threat classification, blacklist status, domain age, and per-check remediation steps. Configure in one click from Account → Integrations.
SwarmHawk_CL table — every field KQL-queryable. Build analytic rules that fire when an AAD user browses a domain SwarmHawk has flagged as phishing-ready. NIS2 compliance flag auto-populated.REST API v2.0, a native Python SDK, and seven ready-to-run adapter scripts for every major SIEM and ticketing platform. No glue code. No re-parsing. Just results.
pip install httpx
from swarmhawk_sdk import SwarmHawkClient
client = SwarmHawkClient(api_key="swh_...")
# Paginated high-risk domains
for domain in client.domains(min_risk=70):
print(domain["domain"], domain["risk_score"])
# Single domain detail
detail = client.domain("example.com")
# New criticals since yesterday
from datetime import datetime, timedelta
alerts = client.alerts(
since=datetime.utcnow() - timedelta(hours=24)
)
# STIX 2.1 bundle for MISP / OpenCTI
bundle = client.stix_bundle()Receive critical findings (risk ≥ 80) the moment scans complete — no polling. The SSE stream delivers JSON events with full domain detail. Works in any language with a standard HTTP client.
const es = new EventSource(
'https://swarmhawk.com/api/stream/alerts?min_risk=80',
{ headers: { Authorization: 'Bearer swh_...' } }
);
es.onmessage = e => {
const alert = JSON.parse(e.data);
// { type:"alert", domain:"...", risk_score:92, priority:"CRITICAL", ... }
console.log(alert.domain, alert.risk_score);
};Purpose-built for the global mid-market — not an afterthought module in a $200k/yr enterprise suite.
| Capability | SwarmHawk Enterprise | Bitdefender Breach Path | XM Cyber | Palo Alto Xpanse | CrowdStrike Surface |
|---|---|---|---|---|---|
External Asset Discovery Continuous, internet-wide scanning |
✓ | Partial | ✗ | ✓ | ✓ |
Breach Path Visualization Attack graph with MITRE labels |
✓ | ✓ | ✓ | ✗ | ✗ |
Organization Graph Clustering Multi-subsidiary asset grouping |
✓ | Partial | Partial | ✓ | Partial |
Choke Point Prioritization Min remediations → max path reduction |
✓ | ✓ | ✓ | ✗ | ✗ |
Global Domain Coverage All ccTLDs + gTLDs, 150+ countries |
✓ 100M+ | Partial | Partial | Partial | Partial |
CTEM Workflow Engine All 5 Gartner stages |
✓ | Partial | ✓ | Partial | ✗ |
Mid-Market Pricing Accessible without $200k+ contracts |
✓ | ✗ | ✗ | ✗ | ✗ |
API v2.0 + Python SDK + Webhooks REST, SSE stream, TAXII 2.1, adapter scripts |
✓ | Limited | ✓ | ✓ | ✓ |
No per-seat fees. No hidden modules. Price scales with your monitored domain footprint.