A retail company runs workloads across Azure, AWS, and several on-premises data centers. The security architect needs a solution that continuously discovers internet-facing assets the organization does not yet know about — including domains, hosts, and IP ranges registered by acquired subsidiaries — and reports discovered vulnerabilities on those assets, all from an outside-in (attacker's) perspective with no need to deploy agents or connectors first. Which capability should the architect specify?