Seed-based discovery is a reconnaissance method that begins with one or more known public assets, such as a domain, IP address, certificate, or hostname, and then expands outward to find related infrastructure. Tools use those seeds to pivot through signals like DNS records, subdomains, certificate transparency logs, ASN and IP ownership, cloud metadata, and linked hostnames.
This matters in cyber security because public infrastructure is easier to enumerate than internal systems, and organizations often do not maintain a complete external inventory. In offense, attackers use seed-based discovery to map exposed services, find forgotten systems, and uncover shadow IT or orphaned assets. In defense, EASM and exposure-management platforms use the same approach to build a live view of internet-facing assets, then prioritize what should be patched, restricted, or removed. The key value is not just finding more hosts, but revealing hidden relationships that make a surface visible from the outside.