Publication Details
| Title | CyberDrishtiX: An AI-Assisted Framework for Continuous Attack Surface Monitoring |
|---|---|
| Presenter | Mohd Abdullah Khan |
| Type | Conference abstract publication |
| Track | Technical |
| Focus area | Leveraging AI in Audits and Assessments |
| Published in | CERT-In SAMVAAD 2026 Conference Proceedings, Abstracts of Paper Presentations (Technical / Management Parallel Tracks), p. 621 |
| Publisher / organiser | Indian Computer Emergency Response Team (CERT-In), Ministry of Electronics and Information Technology, Government of India |
| Conference | CERT-In SAMVAAD 2026, 2nd edition, held 27–29 April 2026 at BITS Pilani, K. K. Birla Goa Campus, Goa |
| Conference theme | “Securing Digital Bharat Through Future-Ready Audits: Adapting, Assuring, Advancing” |
| Official proceedings | cert-in.org.in/PDF/CP_Samvaad-2026.pdf |
Abstract
India operates a vast ecosystem of public-facing web portals, along with numerous servers and digital platforms. Given the scale and continuous evolution of this landscape, maintaining consistent visibility and oversight across all assets at all times remains a significant challenge. As per our research we observed a recurring and concerning trend: live public domains with database credentials exposed in publicly accessible .env files, servers with openly available .git repositories, and sensitive information such as Aadhaar and PAN numbers embedded in downloadable PDFs accessible to anyone. These weren't sophisticated attacks; they were basic hygiene failures which were missed.
This led us to build CyberDrishtiX. It continuously monitors public web portal domains discovering assets through Certificate Transparency logs, scanning for credential leaks and PII exposures, running GitHub searches for accidentally committed secrets.
The more significant challenge was not detection but establishing trust. In an audit context, tools that generate a high volume of unvalidated findings can reduce effectiveness and confidence in the results. To address this, we embedded accuracy validation directly into the workflow: every AI-flagged observation undergoes analyst review prior to disclosure, and we continuously track true positive and false positive rates against defined quality thresholds.
Keywords: Cyber Hygiene Monitoring, Public Web Asset Exposure, Credential Leak Detection, PII Exposure Risks, .env File Misconfiguration, Git Repository Security, Certificate Transparency Log Monitoring, Automated Security Scanning, False Positive Reduction, Continuous Attack Surface Monitoring
About CERT-In SAMVAAD 2026
SAMVAAD is a national annual conference organised by CERT-In to strengthen India's cyber security audit ecosystem. The 2026 edition brought together policymakers, Chief Information Security Officers, regulators, CERT-In empanelled auditing organisations, researchers, and cyber security professionals. Its programme included parallel technical and management tracks, with themes such as audit automation, continuous assurance, artificial intelligence, cloud, APIs, and supply chain security.
About the Project
CyberDrishtiX (साइबर दृष्टि), featured in the projects section of this site, is an AI-assisted platform for continuous attack surface monitoring of public web portals, built for large-scale national cyber audit operations. As described in the abstract, it:
- Discovers assets through Certificate Transparency logs.
- Scans for credential leaks and PII exposure on public domains, including exposed configuration files, open repositories, and sensitive data in downloadable documents.
- Searches GitHub for accidentally committed secrets.
- Validates before disclosing: every AI-flagged observation goes through analyst review, and true positive and false positive rates are tracked against defined quality thresholds.
The platform is built with Python, spaCy, OCR, Node.js, and React. Its central design principle is that in an audit context, trust matters more than raw detection volume: a tool that produces many unvalidated findings erodes confidence in its results.
Why Continuous Attack Surface Monitoring Matters
The central observation in the abstract is that many serious exposures are not sophisticated attacks but basic hygiene failures that go unnoticed because nobody is watching continuously. An annual penetration test shows your security at one moment. New subdomains, forgotten storage buckets, leaked credentials, and misconfigured services can appear between tests. Continuous monitoring complements periodic testing by surfacing those changes sooner. If you want to understand how the two fit together, read the guide to what VAPT is and the CERT-In guidelines and compliance checklist.
Work With Me
The same hands-on experience behind this research goes into client engagements: web application penetration testing, mobile application testing, API security testing, and audit-focused assessments. If you would like to discuss attack surface monitoring or a security assessment, get in touch.