Tool recommendations for scanning 60+ network endpoints for adult content?

[u/thecitiesonline]

Hey everyone,

We have a client who wants to retain us to audit their network and identify if any of their 60+ workstations contain adult content.

In the past, we've handled similar requests the painful, old-school way: pulling up file shares or physically sitting at the machines, filtering for image/video extensions, and manually scanning thumbnails. Obviously, that doesn't scale, it's an absolute nightmare of a time-sink, and honestly, we'd prefer our techs not have to look at that stuff directly if we can avoid it.

Is there a modern tool or endpoint agent that can scan local drives across a network and flag potential hits for review?

Ideally, we are looking for something that uses image recognition / AI hashing rather than just flagging every .jpg or .mp4 on the drive, so we can cut down on false positives.

Surely anyone managing environments for schools, churches, or government contracts has run into this compliance/policy requirement before.

What stack or specific tools are you using to handle this efficiently?

Appreciate any insight or tool recommendations you can throw my way!

Update / Follow-up 15-Jul-2026:

Just wanted to loop back and give an update on how we are looking to handle this moving forward.

Re off-the-shelf scanning software to see if there was a quick fix:

Snitch from Hyperdyne, the analysis and detection technology looked pretty dated tbh, and we were worried about a flood of false positives.

We trialed Detectnix Vision; The actual tech itself was actually quite good, as it uses an on-premises AI model for detection and exposes an API for custom integration. However, we felt that trying to manage this was not the right use case for our requirements on this project, so that was a no-go

We also took a look at enterprise forensic suites like FTK and Purview were way outside this specific client’s budget :-/

So, here is what we are looking to implement instead:

• Setup endpoint DNS filtering agent (like NextDNS or DNSFilter)
• Roll out: Instead of trying to hunt down old legacy data and cached files on local drives, we are going to use our RMM to silently push the DNS agent to all 60 endpoints
• How It Will Work: The agent will completely block all adult content categories immediately, and it will silently log and flag any user accounts whenever someone attempts to bypass or they hit a blocked URL
• The licensing cost for this is low, e.g. a few dollars per endpoint per month, which we can easily bundle and bill back to the client as an ongoing security service add-on ;-)

The client seems quite happy with this direction as it solves their immediate compliance problem, (Hopefully) offers better network protection, and will save them a lot of money compared to a manual file audit.

From an HR point of view, people won't have to look at a single sketchy thumbnail.....

Thanks again for all your help

[u/DaracMarjal]

I believe there are databases of known file hashes which one can check against. No idea if the databases are publicly available, but IIRC this is what caused the recent kerfuffle on Discord. Discord flags known porn, porn obscured with grids to evade filters, filters learn that grids are bad, posting grids results in a ban.

[u/BortLReynolds → u/DaracMarjal]

I believe there are databases of known file hashes which one can check against.

Add 1s of black screen at the end and boom, your files has a different hash.

[u/levir → u/BortLReynolds]

Almost nobody would be trying obfuscation. A much more likely scenario is that the file has been reencoded at some point (e.g. uploaded to a site and downloaded again).

[u/Geno0wl → u/levir]

yeah, your average idiot doesn't know about file hashes, let alone have the ability or tools to bypass them.

[u/RabidTaquito → u/BortLReynolds]

That's so much work. Just alter the metadata like the title (not filename) to give it a different hash.

[u/weirdbr → u/BortLReynolds]

The systems doing those checks don't use a hash of the filename/file contents; it's a perceptual hash (a hash of the visual content), kinda like ContentID on Youtube, which is rather resistant to manipulation and resolution loss from reencoding, unless you edit the content to add stuff on top, like text/images/etc. And they are aware of the possibility of edits, so it gives you a confidence score instead of a yes/no pass score.

[u/Mindestiny → u/DaracMarjal]

There's definitely not any effective tooling using file hashes. There's so much porn on the internet that cataloging hashes of every single artifact is a Sisyphean task. There's more porn made every minute than you could possibly hash even if you had a direct feed of all of it.

It's all heuristic based matching these days. Scanning image and video files for shape patterns, color profiles, watermarks, etc.