Endpoint visibility platforms like Velociraptor are difficult to count accurately from the outside, and this difficulty is a key finding. Velociraptor, an open-source tool for digital forensics, uses agents on hosts and a server to collect data. Exposing this server to the internet means exposing a query interface to all endpoints. A ZoomEye scan reveals 237 assets with "Velociraptor" in their title. However, only two of these are on the commonly documented GUI port, and none are on the agent communication port. This low count doesn't indicate the total number of servers but rather how many are discoverable via specific search criteria. Several factors suppress external counts, including reverse proxies, private network placement, and authentication requirements. A query for "velociraptor" in TLS certificates found 15 matches, suggesting some deployments that use product names in their certificates. The interface itself is critical because it holds valuable forensic data and offers control over endpoints. Platforms are often deployed during incidents and left exposed, creating security risks. Verifying internal configurations and listening sockets is essential for accurate inventory. Checking TLS certificates and separating the GUI from the collection channel are important security practices. Programmatic access credentials for the hunt interface are particularly high-value. The true signal for detection lies in API usage, such as hunt creation, rather than external scans. Unexpected client enrollments can also indicate security issues. External scans are useful for quick scoping during an incident, not for definitive inventory.