What can attackers actually see about your company?
Your external attack surface is everything about your company that is reachable from the public internet: every domain, server, login page, mail record, and leaked password that an attacker can find without ever touching your office or your laptops. It is the map an attacker draws before doing anything else, and here is the uncomfortable part: they usually draw it better than the company can, because they are motivated and the company is busy.
We spend our working lives drawing that map from the attacker's side. This is what is typically on it, in plain language, for a founder or CTO who has never bought security testing.
Subdomains you forgot existed
Your main site is www.yourcompany.com. But over the years the company also created staging.yourcompany.com, old-demo.yourcompany.com, a microsite for a 2022 campaign, and a dashboard some contractor set up. These are all publicly discoverable. Certificate transparency logs, a public record of every TLS certificate ever issued, let anyone list the subdomains you have requested certificates for, using free tools like crt.sh. No hacking involved; it is a lookup.
Why it matters: forgotten subdomains run forgotten software. A staging server with last year's unpatched framework, or a demo instance with a default password, is a real way in. Worse, if a subdomain still points at a cloud service you stopped paying for, an attacker can sometimes claim that service and serve their own content from your domain. The industry calls this a subdomain takeover, and it happens to companies of every size.
Services that should never have been public
Search engines exist for internet-connected devices. Shodan, the best known one, continuously indexes what is listening on the public internet: databases, admin panels, remote desktop, webcams, printers. If your team ever exposed a database "just for a week" to debug something, or a build server, or an internal dashboard, it is findable by anyone with a search box.
The common offenders we see: database ports open to the world, remote desktop or SSH on machines nobody remembers, admin interfaces for routers and firewalls, and CI/CD or monitoring tools with weak or default logins. None of these were decisions anyone made deliberately. They are leftovers, and leftovers are what attackers eat.
Your passwords, from other people's breaches
When a third-party service gets breached, the email addresses and passwords in it end up in public and semi-public dumps. Attackers collect these and try them everywhere else, betting that people reuse passwords. The bet pays.
You can see part of your own exposure right now: Have I Been Pwned, a free public service, lets you check which breaches contain addresses at your domain. If an employee used their work email and a reused password to sign up for a tool that later got breached, that combination may open your actual systems today. This is not exotic. Credential reuse from old breaches is one of the most common ways real intrusions start, and it requires no technical skill at all.
Mail and DNS settings that let people impersonate you
Email has three protective records, SPF, DKIM, and DMARC, that tell the world which servers may send mail as your domain and what to do with mail that fails the test. They are public DNS records, so an attacker checks them in seconds. If DMARC is missing or set to do nothing, mail that perfectly forges your domain can land in inboxes.
The attack this enables is depressingly simple: an email from what appears to be your CEO or your billing address, sent to your customer or your own finance person, asking to change payment details. No system is hacked. Your identity is just borrowed, because a DNS record was never set.
What this means in practice
Notice what all four categories have in common. None of them require breaking anything. They are observations, made from public data, about things your company put on the internet and stopped watching. That is why "what can attackers see about us" is a better first security question than "can we be hacked." The second is speculative. The first has a concrete, checkable answer.
If you want to start yourself, you can: list your subdomains through certificate transparency, look your domains up on Shodan, check your domain on Have I Been Pwned, and read your own SPF and DMARC records. You will learn something, and every one of those steps is free.
Where we come in
The hard part is not running the lookups. It is knowing which of the two hundred results matter, which one is the actual way in, and which are noise. That is judgment, and judgment is what you are buying when you hire people who attack systems for a living.
Our $100 check is exactly this exercise done properly: a focused look at your external surface, on scope you have verified you own and authorized in writing, reviewed by a senior operator, delivered as a ranked report and a 30-minute readout where a human answers your questions. It will not solve your security. It will end the guessing about what an attacker sees, and that is the correct place to start.
External attack surface: quick answers
What is an external attack surface?
Everything about your company reachable from the public internet: every domain, server, login page, mail record, and leaked password an attacker can find without touching your office or your laptops. It is the map an attacker draws first.
How do attackers find subdomains I forgot about?
Mostly through certificate transparency logs, a public record of every TLS certificate ever issued. Free tools like crt.sh let anyone list the subdomains you have requested certificates for. It is a lookup, not hacking.
Can I check my own external attack surface for free?
Partly. List subdomains through certificate transparency, look your domains up on Shodan, check your domain on Have I Been Pwned, and read your own SPF and DMARC records. The hard part is not running the lookups but knowing which of the results actually matter.
What is a subdomain takeover?
When a subdomain still points at a cloud service you stopped paying for, an attacker can sometimes claim that service and serve their own content from your domain. It follows directly from a forgotten DNS record and happens to companies of every size.
Related reading
- How exposed are the top 1,000 domains to email spoofing? Our own measurement of who actually enforces DMARC.
- How much does a penetration test cost?
- Check, scan, or full pentest?
See your attack surface, properly.
Our $100 check ends the guessing about what an attacker sees from the outside, with a senior operator on the readout. It is the correct place to start.
Book a $100 check