Cybersecurity
External attack surface management
You cannot protect what you do not know you have. We find the internet-facing assets attributable to your organization, including the ones nobody told security about, and help assign owners.
The problem this service solves
Marketing launches a microsite on a third-party host. A developer leaves a staging server running. An acquisition brings new domains and certificates. A forgotten subdomain points to a deprovisioned cloud resource that anyone can claim. Each is invisible to internal inventory and visible to anyone scanning the internet.
External attack surface management looks from the outside in. It starts with a small set of seeds, such as company names and domains, and follows certificates, DNS, cloud ranges and public sources to build a list of what exists.
What is in scope
-
Domain and subdomain discovery
Certificates, DNS records and passive sources, including dangling records vulnerable to takeover.
-
IP and cloud ranges
Resources in AWS, Azure and Google Cloud attributable to your organization.
-
Exposed services
Management interfaces, databases, file shares, admin portals and development systems reachable from the internet.
-
Web technology and versions
Identify applications and components with known vulnerabilities.
-
Email and DNS posture
SPF, DKIM, DMARC and DNS configuration review.
-
Leaked secrets and credentials
Public code repositories and paste sites for keys and credentials belonging to your organization, reported through a secure channel.
-
Third-party exposure
Vendors and SaaS platforms hosting your data or brand, noted for follow-up.
How the work runs
Discover
Build the list.
-
1
Seed collection
Gather names, domains, ranges, brands and acquisitions.
-
2
Passive discovery
Use public sources first: certificate logs, DNS data and search engines.
-
3
Active confirmation
Within agreed scope, probe discovered assets to confirm they exist and what they run.
Validate
Separate yours from not yours.
-
4
Attribution
Confirm ownership using evidence, to avoid reporting or testing assets that belong to others.
-
5
Risk assessment
Identify exposed services, outdated components and takeover risk.
Act
Hand to owners and keep it current.
-
6
Owner assignment
Match assets to teams and open tickets with context.
-
7
Monitoring setup
Define recurring discovery and a change alert process.
What you receive
- Validated internet-facing asset inventory
- Exposure findings, ranked
- Subdomain takeover candidates
- Email authentication posture review
- Ownership proposals
- Recurring discovery plan
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Company and brand names, known domains and acquisitions
- Authorization to actively probe discovered assets within scope
- A point of contact to confirm ownership of unknown assets
What this service is not
- A penetration test of discovered assets
- Testing assets we cannot attribute to you
- A dark-web monitoring or threat-intelligence subscription
What changes afterwards
- You have an accurate list of what you expose
- Forgotten and risky assets are removed or secured
- New exposure is noticed in days, not years
Questions people ask
Will you scan things we do not own?
We scan only assets we can attribute to you with evidence. Anything uncertain is listed for you to confirm before any active probing.
How often should this run?
Continuously or at least monthly. External changes happen daily, and new exposure is easiest to fix right after it appears.
What do you do with leaked credentials we find?
We report them privately and recommend rotation. We do not test or use them.
Related
-
Continuous threat exposure management
Move from periodic scans and tests to a repeating cycle of scoping, discovery, prioritization, validation and mobilization.
-
Network penetration testing
External and internal network testing: exposed services, weak authentication, segmentation gaps and lateral movement paths.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response