Getting started

This is the five-minute walkthrough every new operator should run once. After this you’ll have at least one active target, a handful of discovered hosts, and (if you’re on a paid plan) one AI-validated critical finding.

1. Sign up

Head to app.umbrascope.com/#/signup: work email, a 12-character password, and a workspace name. We send a verification link; the link expires in 24 hours but you can request a fresh one from the same screen.

The first user in a workspace is automatically the org owner. They manage billing, can transfer ownership to another admin, and can’t be removed by anyone else.

2. Add your first target

A “target” is the thing Umbra scans. Three accepted shapes:

• Single IP: 203.0.113.42
• CIDR range: 203.0.113.0/24 (up to a /22 in the discover preview; for larger ranges, split into multiple targets)
• Hostname: vpn.acme.com

Add it under Admin → Targets → Add target. Discovery starts immediately (the worker picks up the job within a few seconds).

Authorisation matters. Umbra runs real port scans against the IPs you add. Only add what you have authorisation to scan. Unauthorised scanning is a CFAA / Computer Misuse Act issue in most jurisdictions. The signup flow’s checkbox isn’t legal advice; it’s a record that we asked.

3. Pick which hosts to monitor

Discovery typically finds 10–500 live hosts per /24. Your plan’s asset cap meters how many of those count against your subscription, not how many you discover. Open Assets, tick the hosts you actually want monitored, and click Start monitoring.

Untracked hosts stay in the discovered pool. You can swap them in and out as the surface changes (no penalty, no re-scan required).

4. See findings

Within a few minutes of the first discover scan completing, exposed services + matched CVEs land in Findings. Matches are gated by the detected version, so a patched build doesn’t light up with CVEs it already fixed. KEV-listed CVEs (CISA’s known-exploited list) and high-EPSS CVEs (most likely to be exploited) are surfaced first; severity-critical findings get a red border.

5. Validate the critical ones with AI (paid plans)

Click Verify on any critical CVE row. The AI agent confirms exploitability against the live service and writes a one-page proof you can paste into a Jira ticket. You’ll see the estimated cost before each run; runs are debited from your bundled monthly AI allowance first, then your top-up balance.

The free tier doesn’t include AI validation. Upgrade to Starter or above to unlock it.

What next

• Asset-pool model: why we count tracked hosts instead of discovered hosts, and how to swap them efficiently.
• AI validation: how the agent works, what it costs, how to set per-run ceilings.