Every publicly-trusted TLS certificate gets logged to a public Certificate Transparency log the moment it's issued, that's not optional, it's how the CA ecosystem works post-2018. Which means every new subdomain someone spins up, every cert a phishing look-alike domain requests, every bit of shadow IT that gets a real cert, shows up in CT logs before it shows up anywhere else. Most security teams find out about that stuff from a customer complaint or a pentest finding instead, because nobody's actually watching the logs.
You can watch them yourself for free, crt.sh is a public, community-run search interface over CT log data, no login required. The gap is turning that into monitoring: crt.sh's web UI is built for one-off lookups, not for a repeatable check you run against your own domain on a schedule or wire into an alerting pipeline. The paid options that solve that (Censys, SSLMate's CertSpotter) are built for it, but they're attack-surface-management platforms, you're paying for a lot of adjacent tooling to get access to what's structurally a single API call: "what certs have been logged for this domain recently."
That's the specific gap Certificate Transparency Monitor fills. Feed it a domain, get back every certificate logged against it and its subdomains, common name, all SANs, issuer, validity window, straight from CT log data via crt.sh, deduplicated by serial number so the same cert logged to multiple logs doesn't show up twice. No proxy, no scanning, no login. It's built to slot into whatever you're already using for scheduled checks or alerting, rather than replacing them.
Pricing is per search, not per certificate, one $0.007 charge whether the search turns up 1 cert or 200, so running it daily or weekly against a handful of domains costs cents, not a platform contract.
See it alongside the rest of the risk-monitoring actors in the portfolio, including Vulnerability Alert for new CVEs by product and severity, and Website Tech Stack Detector for a tech fingerprint per domain.