A retail company has grown through acquisitions and suspects it has numerous internet-facing assets that were never registered with IT — legacy marketing microsites, forgotten cloud storage endpoints, and expired certificates on subdomains. Security leadership wants an authoritative, continuously updated inventory of externally reachable assets discovered from the perspective of an outside attacker, without requiring agents or credentials on those assets. Which capability should the security architect recommend to establish this inventory?