What is an attack surface?
Your external attack surface is everything an attacker can reach from the internet. Here is what it consists of, why it grows without anyone deciding it should, and how to keep it small.
By the TrustSek editorial team · Last reviewed
- Module
- Attack surface
- Access needed
- None
- Method
- Public evidence
Everything an attacker can reach.
An attack surface is the sum of the points where someone could try to get in. The external attack surface is the part that faces the internet: the parts anyone can find and reach without first getting into your network. It is usually larger than the organisation thinks.
It typically includes:
- Domains and subdomains, including old campaign sites, test and staging systems, and hosts set up by a supplier on your behalf;
- Websites and web applications, and the software versions they run;
- Mail servers and the DNS records that describe them;
- Open ports and services beyond the web: remote desktop, VPN gateways, databases, file transfer, admin panels;
- Cloud services and SaaS reached through your domain;
- Lookalike domains registered by others to impersonate you in phishing.
Why it grows without anyone deciding it should.
No one plans a large attack surface. It accumulates. A project spins up a staging server and never takes it down. A marketing campaign gets its own subdomain that outlives it. A supplier opens a remote-access port for support. A team signs up for a service and points a subdomain at it. Each one is a host that someone must patch, configure and eventually remove, and the ones nobody owns are the ones that are attacked.
Map your own.
You can see much of your own external surface with public sources:
- Certificate transparency logs list every publicly trusted certificate issued for your domain, which reveals subdomains you may have forgotten.
- Your DNS zones show every name you publish. Compare them with what you think you run.
- A port scan of your own address ranges shows which services answer. Scan only addresses you are responsible for.
- A search for lookalike domains, with letters swapped or added, shows which ones others have registered.
Shrink it.
- Give every internet-facing host an owner. Hosts without an owner are the ones that go unpatched.
- Remove what is not needed: old subdomains, test systems, services left from past projects.
- Put administrative interfaces behind a VPN or single sign-on, never directly on the internet.
- Keep public software patched, starting with vulnerabilities known to be exploited.
- Register the lookalike domains that matter most to you, and watch for new ones in phishing reports.
What an outside-in assessment shows.
The attack surface module assesses a domain's surface from public evidence at the time of the scan. It is a point-in-time assessment, not continuous monitoring. Among the findings it can raise:
| What the scan finds | Finding | Severity |
|---|---|---|
| Twenty or more subdomains | Moderate attack surface: 20+ subdomains | Medium65 |
| Subdomains named like admin, staging or VPN hosts | High-Risk subdomains detected | Varies |
| Many open ports beyond 80 and 443 | Many open ports detected | High75 |
| A domain registered within the last 30 days | Domain registered very recently | High80 |
| Lookalike domains flagged by threat intelligence | Malicious lookalike domains detected | Critical90 |
The module page lists every finding with how it is tested and how to fix it. Software versions with known vulnerabilities are assessed separately, in the vulnerabilities module.
Questions
Is attack surface the same as vulnerabilities?
No. The attack surface is what can be reached; a vulnerability is a weakness in something that can be reached. A smaller surface means fewer places where a vulnerability can matter.
Can an outside-in assessment see our whole attack surface?
No. It sees what public sources and the internet show: published names, answering services, registered lookalikes. Systems reachable only from inside your network, or only through a supplier, are outside its view.
See your domain from the outside
Check your domain and see the attack surface findings alongside the rest of the outside-in score.