Attack Surface Management

The two differ in shape rather than quality. Attack surface management is broad, shallow and recurring: it answers what you expose to the internet right now and which parts of that exposure look wrong, across an estate that keeps changing. A penetration test is narrow, deep and point in time: it takes an agreed scope and tests it hard by hand for a fixed window, proving impact with a working exploit. Neither replaces the other. Without discovery, a test scope is only as good as your asset register, and most registers are out of date. Without testing, a discovered exposure stays a suspicion rather than a proven risk. In practice clients run this service through the year and schedule tests against what it surfaces. When a finding needs proving rather than reporting, we hand it into a full VAPT engagement and test it properly.

We discover the domains, subdomains, IP ranges, cloud-exposed services and certificates attributable to you, then check them for exposures an attacker would use as a starting point: open ports and reachable services, outdated software versions, exposed administrative interfaces, weak DNS and email authentication records, and certificate or TLS problems. We also report shadow IT and third-party exposure that we can see from public sources, such as forgotten staging sites and supplier-hosted systems presenting under your domains. We are equally clear about what is outside this service. We do not monitor dark web marketplaces or breach forums, we do not exploit what we find, and we do not watch your estate around the clock; discovery and reporting run on an agreed cycle. Deeper work, such as proving that an exposed service can actually be compromised, belongs in a scoped penetration test.

Discovery and exposure checks run monthly by default, with the shadow IT and third-party review each quarter, and we agree a cadence that matches how fast your estate changes. Each cycle you receive a refreshed inventory of internet-facing assets, the validated exposure findings ranked by business impact, and a report that separates what is new, what changed and what closed since the last cycle. That last part is what makes the service useful over time: the value is not a one-off list but a trend you can act on and show to your leadership. Remediation guidance goes to the named owner of each asset rather than into a general pile, and when you tell us a fix is in, we retest that finding and record whether it genuinely closed. A closed finding means fixed and retested, not acknowledged.

A tester reviews every finding before it reaches you. Automated discovery is how we cover a large external estate quickly, but raw output is a poor deliverable: it mixes assets that are not yours with services that are deliberately open and version guesses that are wrong, and it ranks everything by a generic severity score that knows nothing about your business. So we confirm each finding by hand, discard the false positives, and rank what remains by how reachable it is, how sensitive the system behind it is and what an attacker could do next. Related findings that one change would close are grouped into a single fix rather than listed five times. The result is a shorter list than a scanner would produce, which is the point: you should be able to work through a cycle's findings rather than triage them.

Asset inventory is the first thing almost every framework asks for, and it is the control organisations most often cannot evidence. This service produces that evidence. It maps to CIS Controls v8 Controls 1 and 2, the inventory of enterprise assets and of software, and to the identify function of NIST CSF 2.0, specifically the ID.AM asset management outcomes. Under ISO/IEC 27001:2022 it supports Annex A 5.9, the inventory of information and other associated assets, and Annex A 8.8, the management of technical vulnerabilities, with a dated record of what you exposed and when you fixed it. It also helps in the general sense the CERT-In Directions assume, which is that an organisation knows which internet-facing systems it runs before it has to report an incident on one. We supply the inventory and the exposure history as audit evidence.