OSINT & Attack Surface Assessment

We start from what you own: primary domains, brand names, known IP ranges, acquired companies. From those seeds we expand outward through passive DNS, WHOIS history, autonomous-system lookups and certificate transparency, pulling in every asset that traces back to your organization. Acquisitions and old brands are a common source of surprises here.

With the domain space mapped, we enumerate subdomains and fingerprint the services behind them using passive sources such as Shodan and Censys. This tells us what technology is exposed, which software versions are running, and where an old appliance or a forgotten staging server is quietly listening on the internet. We never actively exploit anything at this stage; the point is visibility.

People leak more than infrastructure does. We search public code repositories for hardcoded API keys, cloud credentials and connection strings, comb breach and combolist data for employee logins tied to your domains, and check for open cloud storage that indexes itself to the world. A single valid credential in a paste site can undo an otherwise solid perimeter.

Raw findings are only useful once they are prioritized. We correlate the discovered assets, flag the ones that represent real risk such as an exposed admin panel or a leaked live credential, and rank them by how easily an attacker could turn them into access. The result is a shortlist you can act on this week, not a data dump.

The single most common finding is an asset nobody remembered. A demo environment left running, a subdomain from a campaign that ended, an old mail server that never got decommissioned. These sit outside patching and monitoring, which is precisely why attackers love them.

Employee passwords appear in breach dumps constantly, and people reuse them. We match leaked credentials to your domains so you know which accounts to force-reset. In parallel we look for developer secrets committed to public repositories, where an AWS key or a database password can open a direct path in.

When a service is retired but its DNS record is left pointing at the now-free cloud resource, an attacker can claim that resource and serve content from your domain. We flag every dangling record so you can clean them up before someone hosts a phishing page on your own brand.

Admin interfaces, database consoles and monitoring dashboards routinely end up reachable from the internet by mistake. Publicly listable cloud storage is just as common. Both are catalogued with enough detail for your team to lock them down fast.

Public documents give away more than their contents. File metadata reveals internal usernames, software versions and folder paths, and it accumulates in PDFs and office files published on your own site. We surface this leakage because it hands an attacker the naming conventions and internal detail that make later social engineering far more convincing.

You get a complete list of the internet-facing assets we tied to your organization, each with its discovery source, the technology fingerprint, and a risk rating. For many clients this is the first accurate inventory of their own perimeter they have ever held.

Each exposure comes with a plain description, the evidence, the likely impact, and a specific fix. Leaked credentials get a reset list. Dangling records get the exact DNS entries to remove. Exposed services get a decommission or restrict recommendation. A free re-scan afterward confirms the surface has actually shrunk.

An attack surface assessment pairs naturally with a penetration test. Once you know what is exposed, an active test can safely probe the assets that matter most. Many clients use this engagement to scope a follow-on external network or web application pentest with confidence.

ISO 27001:2022 controls A.5.9 and A.8.1 expect a maintained inventory of information and associated assets. An external attack surface assessment gives you evidence that internet-facing assets are identified and managed, including the ones outside your official register.

The GDPR’s article 32 calls for appropriate technical measures to secure personal data, and you cannot protect an asset you do not know exists. For entities under NIS2, understanding and reducing the external attack surface directly supports the risk-management and asset-visibility duties the directive imposes. Where clients want ongoing assurance, we run external attack surface management on a recurring basis so new exposures are caught as they appear.

Throughout the assessment we only observe. We query public records, indexes and datasets that anyone could reach, and we never log in, exploit, or send traffic designed to trigger a system. That is what makes the engagement safe to run against production without a maintenance window, and it is why we can start without a long authorization chain.

Attribution errors are a real risk in this work, because a subdomain or an IP can look like yours without being yours. We confirm ownership before anything lands in the report, so you are not chasing an asset that belongs to a neighbor on shared hosting or a former supplier. Anything we cannot confirm is flagged as unverified rather than asserted.

The findings from this work are a map of exactly how to attack you, so they are sensitive by nature. We handle everything under NDA, deliver through secure channels, and can destroy our copy of the data on request once you have the report. Leaked credentials are shared in a form your team can act on without exposing them further.