External Attack Surface Monitoring
Your internet-facing footprint changes every time someone launches a site, adds a subdomain or opens a port. Attack surface monitoring keeps an up-to-date inventory of what is exposed — and tells you when it changes.
How this assessment works
Forgotten test environments, old marketing sites and services opened "temporarily" are a common way into an organisation. They are rarely included in an annual test because nobody remembers they exist.
Monitoring runs on a regular schedule against the domains and IP ranges you have authorised, and flags changes that deserve a closer look.
Testing Methodology
Scheduled automated discovery and checks. Significant changes are reviewed by a person before being reported to you as findings.
Deliverables
- Current inventory of discovered in-scope assets
- Change and exposure notifications for significant issues
- Regular summary reports on your attack surface
- Recommendations on what to remove, restrict or investigate
Every deliverable is written in plain English, with proof-of-concept evidence and prioritized remediation steps.
Coverage
What we examine during testing
Our structured approach ensures comprehensive coverage across the agreed scope.
Subdomain and DNS discovery
Identifying hosts associated with your authorised domains.
Port and service changes
Detecting newly exposed services on in-scope hosts.
Technology identification
Recording the software and versions your assets advertise.
Certificate monitoring
Tracking certificate expiry and misissued or mismatched certificates.
Exposure alerts
Flagging administrative panels and services that should not be public.
Inventory history
A record of how your attack surface changes over time.
Who this service is best for
- Organisations with several websites, domains or cloud services
- Businesses that rely on third parties to manage web infrastructure
- Anyone who wants visibility between penetration tests
Scope boundaries & limitations
Monitoring only observes what is publicly reachable on the domains and ranges you authorise. It identifies exposures; it does not replace hands-on penetration testing.
Need internal network or custom web application testing? Contact us to discuss tailored scoping.
What Is an External Attack Surface and Why Should You Monitor It?
Every internet-facing asset your organisation operates is part of your external attack surface. Understanding what that includes — and how it changes — is the first step toward meaningful security.