Compliance-ready vulnerability scanning for government agencies

Local and regional government runs a sprawling public footprint on a fraction of an enterprise security budget. A single county or mid-sized city typically operates dozens of internet-facing assets: the main .gov site, online permit and licensing portals, property-tax and utility-billing systems, court records search, GIS/parcel viewers, public-meeting and records-request portals, job-application sites, and a long tail of department subdomains. Many of these run aging vendor software (Tyler, Accela, CivicPlus, Granicus, NIC and similar civic-tech platforms) on infrastructure that was stood up by a contractor years ago and is now only loosely tracked. The result is a large, externally visible surface with no single owner — exactly the conditions where forgotten subdomains, expired certificates, and unpatched portals accumulate.

The threats are well-documented and ongoing. State and local government is one of the most-targeted sectors for ransomware, and attackers consistently get their initial foothold through external exposure rather than zero-days: exposed remote-access services (RDP on 3389, VPN appliances with known CVEs), internet-reachable admin panels, and credential reuse. CISA's Known Exploited Vulnerabilities catalog is dominated by edge devices — Fortinet, Ivanti/Pulse, Citrix ADC, Exchange — precisely the gear that fronts municipal networks. Email-spoofing of trusted .gov domains is a parallel risk: agencies without enforced SPF/DKIM/DMARC are routinely impersonated in benefit-fraud and invoice-redirect schemes aimed at residents and vendors.

External scanning addresses a specific, high-value slice of this problem and it is honest to be precise about which slice. FortWatch continuously maps what an attacker can see from the public internet — open ports and exposed services, known-CVE and missing-hardening signals on web-facing software, SSL/TLS and certificate posture, DNS and email-authentication hygiene, security headers, exposed sensitive files like .env or .git, subdomain takeovers on deprovisioned vendor services, public cloud buckets leaking records, and lookalike domains used to phish residents. It does not replace an authenticated internal vulnerability program, a penetration test, or the access controls and logging required inside the network. Its job is to make sure the front door is not left open and to give a small IT team a prioritized, AI-explained list of what to close first.