DISCOVERY
Define exactly which systems and actions are permitted before execution.
EXTERNAL ATTACK SURFACE
External attack surface assessment
We discover domains, IPs, subdomains, services, cloud resources, panels and technologies visible from the internet. Assets are linked to ownership, actual exposure is validated, and the client receives a prioritized surface map rather than an unverified alert list.
Request an audit
01 / ANALYSIS
From technical signal to a verifiable finding
Identify domains, subdomains, services, technologies and relationships visible from the Internet to reduce unknown exposure.
- Related asset discovery
- Reachable ports, services and technologies
- Relationships between domains, applications and services
- Prioritization of external paths requiring review
02 / WORKFLOW
How our Red Team works
Automation discovers; specialists validate
CONTEXT
Each signal is connected to the asset, exposure and potential impact.
VALIDATION
The specialist controls confirmation and final recommendations.
03 / CONTROL
Agreed scope and confidential evidence
Targets, evidence, vulnerabilities and results are shared only with authorized client contacts.
Evidence and context
Each signal is connected to the asset, exposure and potential impact.
Human validation
The specialist controls confirmation and final recommendations.
TECHNICAL SCOPE
What external attack surface analysis discovers
Infrastructure changes continuously. Forgotten domains, temporary services, staging environments and cloud assets can remain visible without being tracked by the team.
Domains, subdomains and DNS relationships
Exposed addresses, services and ports
Observable technologies and components
Panels, APIs and development environments
Cloud, CDN and provider relationships
Potential connections forming attack paths
OUTCOMES
External visibility to reduce unknown exposure
Observed asset inventory
Exposure and priority classification
Relationships across assets and technologies
Recommendations to reduce public surface
WHEN IT HELPS
When we recommend this assessment
After migrations, acquisitions or cloud changes
When the external inventory is outdated
Before penetration testing or Red Team work
FREQUENTLY ASKED QUESTIONS
Direct answers before requesting an assessment
Is this the same as an internal inventory?
No. It shows what an external attacker can discover from the Internet within the authorized scope.
Are third-party assets tested?
Only relevant relationships are documented. Active testing is limited to explicitly authorized systems.
Can you find forgotten subdomains?
The methodology uses DNS, certificate and other signals to identify potentially unmanaged assets.
What happens after discovery?
Exposed assets are prioritized and can move into vulnerability validation or controlled testing if agreed.