External Attack Surface Assessment
An external attack surface assessment maps everything your organisation exposes to the internet, including the subdomains, cloud resources and forgotten hosts that never made it onto your asset list.
What the Assessment Covers
Attack surface mapping from the outside in. We find every domain, subdomain, IP range, cloud resource and third party service that belongs to you and can be reached from the internet. Then we look at what each one is running and whether it should be there at all. The assessment is led by discovery and nothing is exploited, so it is safe to run against live systems at any time.
Why Asset Lists Go Wrong
No organisation sets out to lose track of what it runs. Projects end and the server stays. Departments commission their own sites. A supplier configures something and nobody writes it down. Acquisitions arrive with infrastructure nobody here specified. The people who knew why a host existed move on and the knowledge goes with them. None of that is negligence. It is what any estate does over time. Attackers do not care why it happened. They scan constantly and the forgotten host is the one nobody is patching or watching.
Four Questions for Every Asset
Finding an asset is half the job. Once the list exists, four questions decide what happens to each entry. What is exposed? Who owns it? What is it for? What breaks if it is switched off? Where the second or third has no answer, the fourth is usually the useful one. Very little of what turns up still needs to be reachable and switching it off costs nothing.
What You Get From the Assessment
Find Forgotten Assets
Uncovers subdomains, test environments and services left running after a project ended or a supplier moved on.
See What an Attacker Sees
Builds the picture from the same public sources an attacker would start with.
Know Where to Start
Ranks every exposed asset by risk so your team deals with the most exposed systems first.
Set the Scope for Testing
Gives you an accurate asset list to check against your own records before any penetration test is scoped.
How the Assessment Runs
We start with what you know: your domains, address ranges and company names, including any businesses you have acquired. From there the footprint is built from the same public sources an attacker would use, such as DNS records, certificate transparency logs, internet wide scan data and cloud provider ranges. Each asset is checked for what it is running, open ports, outdated software, expired certificates and exposed login or management pages. Anything we cannot tie to you with confidence is flagged for you to confirm rather than assumed to be yours. The whole assessment runs from the public internet without intrusive testing, so it does not affect your operations. The report lists every asset with its risk and a recommended action.
At a Glance
Asset Discovery
Domains, subdomains, IP ranges and cloud services found from public sources.
Footprint Mapping
Everything found compared with your records, including assets that have drifted out of your inventory.
Risk Analysis
Each asset checked for open ports, outdated software, expired certificates and exposed logins.
Prioritisation
Assets ranked by risk so your team deals with the most exposed first.
Report & Retest
Full asset report with risks and recommended actions. Free retest included. Fully remote.
Findings appear in your client portal as we find them. Our day rate is published on the pricing page.
You May Also Be Interested In
Frequently Asked Questions
What is an external attack surface assessment?
An external attack surface assessment maps everything your organisation is presenting to the public internet, including assets you may not be aware of. This includes registered domains, subdomains, IP ranges, cloud services, third party integrations and any other infrastructure that can be reached from outside. The goal is to give you a complete and accurate picture of your digital footprint before an attacker builds it for you.
How is this different from external infrastructure penetration testing?
External infrastructure testing assumes a known scope and goes deep on a defined set of systems. An attack surface assessment is discovery first: it finds and maps everything before any testing begins. It is often used as a precursor to penetration testing to ensure nothing is missed, or as a standalone engagement for organisations who want visibility over their exposure without active exploitation.
What is shadow IT and why is it a risk?
Systems or cloud services set up without IT or security knowing about them. A team needs a tool, signs up for a service or commissions a site. Nobody adds it to the asset list. It is rarely patched, rarely monitored and nobody is responsible for it, which makes it the easiest thing on your perimeter to attack.
Can you find assets we don’t know about?
Yes. That is what the assessment is for. Certificate transparency logs, DNS records, historical data and cloud provider ranges regularly turn up assets the organisation did not know it had: forgotten subdomains, old cloud resources, development environments and infrastructure from acquired companies that was never decommissioned.