Seccuti
Use case

What you expose, tested rather than listed.

Discovery on its own produces an inventory. Seccuti discovers the surface and then tests it, which is the part that tells you whether the exposure matters.

Discovery
Hosts, services, subdomains and reachable files, recorded against the asset they belong to.
Testing
The discovered surface is worked, not just catalogued.
Scope
Discovery never widens what may be tested. A newly found host is out of scope until you add it.
Output
A tested surface, with the untested parts named.

Start with this one use case.

One target is enough to judge the output.