This session was only about the recon dashboards. We showcased an internet dashboard that visualizes how much recon and attack activity happens in the world and how much attack surface spawns every minute.

The dashboard showed metrics such as: volume of scanning and reconnaissance activity by region and over time, counts and trends of attacks or exploit attempts, and the rate at which new attack surface appears (e.g. new services, domains, or exposed assets coming online). We walked through what the data represents, how it’s collected and normalized, and how to read the dashboard to spot trends and hotspots. Attendees could see in near real time how the global attack surface and threat landscape change.