Attack surface sounds like enterprise vocabulary, and the underlying question is simple: what of yours can be reached from the internet? Very few organisations can answer accurately, while automated scanners answer it continuously for anyone who asks.

How your surface is discovered

  • Certificate transparency logs, which publicly record every TLS certificate issued — including for subdomains you assumed were private.
  • DNS enumeration against common subdomain names.
  • Search engine indexing of pages nobody intended to publish.
  • Internet-wide scanning services that catalogue open ports and services continuously.
  • Code repositories and job adverts revealing internal systems and technologies.

What organisations typically find

A staging site with production data and no authentication. An old marketing microsite on an unpatched platform. An administrative login exposed to the internet. A development API with permissive settings. A forgotten server from a project that ended. Almost none of it is currently needed, which is what makes the fix straightforward.

How to enumerate your own

Start with a certificate transparency search for your domain — several free tools query these logs and the results are frequently surprising. Review your full DNS zone, including records nobody has looked at in years. Check what search engines have indexed for your domain. Then, for anything internet-facing, confirm what service is running and whether it is supported and patched.

Prefer removal over hardening

The best outcome for most findings is deletion: decommission the old staging site, remove the DNS record, shut down the unused server. Hardening something nobody needs is ongoing maintenance for no benefit. Removal ends the exposure permanently and reduces the inventory you must keep patched.

For what must remain exposed

  • Put administrative interfaces behind authentication and, where possible, network restriction.
  • Ensure everything internet-facing is on supported, patched versions.
  • Remove version banners and detailed error pages that fingerprint your stack.
  • Apply rate limiting and monitoring to anything accepting input.

Make it recurring

Surface grows continuously as projects launch and staff leave. A quarterly enumeration — an hour with the tools above — keeps the inventory honest and catches the staging environment somebody spun up and forgot.