Attack Surface Analysis
How your organisation looks from outside, set down with evidence
We set down how your organisation looks to an attacker from outside, as a list of assets backed by evidence.
We find your domains, IP addresses and the servers, services and admin screens open to the internet, and look at their history and changes. For each asset found we check the evidence that it is yours, and mark separately those whose owner is not yet confirmed, so your staff can check them.
What of ours is open to the internet, and is any of it unknown to us?
We set out the assets found from outside with their evidence, mark those whose ownership still needs confirming, and show what to act on first.
Reviewed
When it fits
- You worry about assets you don't know of
You want to find domains or servers open without your knowledge, and set down once how your organisation looks to an attacker from outside.
- Your organisation or systems have changed a lot
After a merger or acquisition, a move to the cloud, or a service being redesigned or shut down, you want to check that your asset list matches what is actually open to the internet.
- Many teams and suppliers open new assets
Campaign sites, test servers and other assets set up by many teams and suppliers have piled up, and you want to find the ones nobody is clearly looking after.
- Before setting the scope of testing
Before commissioning vulnerability assessment or penetration testing, you want the assets seen from outside set down first, so nothing is left out of scope.
What we look at
We look at what can be seen from outside and, for each asset found, whether it is yours and on what evidence.
Names and addresses
- Domains and subdomains
- IP addresses and ranges
- Names that appear in certificates
- Addresses tied to cloud services
What is open to the internet
- Websites and services
- Login and admin screens
- Remote access points
- APIs and file storage open to the internet
Ownership and change
- Assets whose owner is not confirmed
- Assets missing from your asset list
- Assets still open after they fell out of use
- Assets that appeared or disappeared, and their history
An event site still open after the campaign ended, a test server a supplier set up and never handed over, or an admin screen left on an old domain.
How it runs
Agree the targets
We agree the organisation and brand names, the domains and IP addresses you know of, whether affiliates are in scope, and the assessment period or monitoring interval.
Gather and link
We gather external observations and link them through their relationships and history to draw up the assets that may be yours.
Confirm ownership
Analysts review the evidence that each candidate is yours, and separate confirmed assets from those whose ownership still needs checking and those that are not yours.
Report
We explain the asset list and its evidence and the priorities for action based on the likely impact, and hand over the items for your staff to check.
It can run as a one-off assessment or, if you often open new domains and services, as monitoring that checks for changes at an agreed interval. See the three ways to run it
What you receive
Assets found, with evidence
For each asset found from outside, the evidence that it is yours, when it was first seen and what has changed.
Assets whose ownership needs confirming
Assets that look like yours but lack evidence, gathered separately so your staff can check them.
Priorities for action
Based on the likely impact, what to close or add to your asset list first.
A baseline for next time
This result is kept as a baseline, so the next assessment or monitoring round can compare what has changed.
Being visible from outside is a reason to check, nothing more. Whether an asset found has a vulnerability, or can actually be exploited, is not judged in this analysis; where needed, it is checked in a separate assessment.