The external attack surface of a mid-sized organisation is usually larger than its asset register

Ask an organisation of two hundred people what it exposes to the internet and you will generally get a short, confident answer: a website, a mail service, a VPN endpoint, perhaps a customer portal.

Enumerate the same organisation from outside and the list is longer, and the additions are rarely things anyone decided to publish. 

This is not a failure of competence. It is the predictable result of a decade of incremental change across cloud services, acquisitions, remote working and supplier integrations, with nobody holding a complete view.

The useful question is not whether the gap exists but what tends to be in it. 

How the outside view is built

External enumeration does not begin with scanning. It begins with establishing what belongs to the organisation, which is the part that most asset registers get wrong. 

Certificate transparency logs are the single most productive starting point. Every publicly trusted certificate issued is logged, which means subdomains that were never linked, never indexed and never documented are nonetheless discoverable by anyone willing to read the logs.

Staging environments, legacy applications and internal tools given a certificate for convenience all surface this way. 

Passive DNS, historical records and reverse lookups extend that. Autonomous system and netblock data establishes which addresses an organisation actually controls.

Search engines built for internet-wide scan data, Shodan among them, provide service banners and software versions without touching the target at all. 

Only after that does active work begin, and by then the interesting findings are usually already apparent. 

What consistently turns up

Remote access that outlived its purpose. The most common finding across every sector. Access published quickly during 2020, documented informally or not at all, and never withdrawn because nobody could confirm who was still using it.

Frequently this is a remote desktop gateway or a management interface rather than a VPN, and often it is on a non-standard port in the belief that this constitutes a control. 

Staging and development environments. Reachable, indexed, and running a copy of production with weaker authentication, verbose error handling and sometimes real customer data.

Development environments are built for iteration speed and then inherit a public address nobody revisits. 

Forgotten infrastructure from acquisitions and rebrands. An acquired company’s mail server, a previous brand’s website still resolving, a marketing microsite built by an agency on infrastructure the organisation does not administer.

These are owned in the sense that matters to an attacker and unowned in the sense that matters to patching. 

Management interfaces. Firewall, hypervisor, storage and building management consoles exposed because remote administration was convenient.

These are high-value, frequently run firmware well behind current, and are rarely covered by the patching process that governs servers. 

Credentials in breach corpora. Not infrastructure, but part of the same picture. Corporate addresses appearing in historical breach data, with passwords that are reused, or that are the same base word with a different number on the end. 

The pattern across all five is the same: none of them were published by mistake in a technical sense. Each was a deliberate decision at the time, made by somebody who did not remain responsible for it. 

The regional picture

Testing across the north west and the midlands, the composition changes with the local economy rather than the controls changing. 

In Greater Manchester, the concentration of professional services, digital agencies and software businesses pushes the surface towards web applications, APIs and the long tail of client-facing environments.

An agency may hold infrastructure for dozens of clients, which makes it a supply chain concern as much as an individual one.

Work on penetration testing Manchester engagements tends to be weighted towards application logic and authorisation rather than perimeter infrastructure, because the perimeter is largely somebody else’s cloud. 

Around Birmingham and the wider West Midlands, manufacturing and engineering change the shape.

Operational technology, machine controllers, and site systems that were never designed to be internet-reachable but became so through a remote support arrangement with a vendor.

The characteristic finding on penetration testing Birmingham work is not a web application flaw but a flat network behind a single exposed service, where reaching the office estate and reaching the plant floor are the same problem. 

Neither picture is unique to a city. The point is that the surface reflects what the organisation does, which is an argument for enumerating a specific estate rather than applying a generic checklist to it. 

Why the asset register is usually behind

Three structural reasons, none of them solved by better intentions. 

Asset registers record what was provisioned through a process. A large share of external exposure arrives outside one: a developer spinning up an environment, a department buying a SaaS tool on a card, a supplier being given a tunnel for support. 

Second, registers record creation and rarely record removal. Decommissioning is unglamorous and nobody is paged when it does not happen. 

Third, ownership of external exposure is genuinely ambiguous in most organisations. Infrastructure belongs to IT, applications to development, domains occasionally to marketing, and supplier connections to whoever negotiated them.

The gaps sit precisely on the boundaries. 

What actually helps

Enumerate from outside, on a schedule. The view that matters is the one an attacker builds, and it changes continuously. A point-in-time list produced internally will be wrong within a quarter. 

Start with certificate transparency. It is free, it is passive, and it reliably returns hosts that nobody has thought about in years. For most organisations it is the highest-yield hour available. 

Treat removal as part of the build. A deployment process that does not have a corresponding teardown produces exposure at a steady rate indefinitely. 

Separate “we own it” from “we administer it”. The agency-built microsite and the acquired company’s mail server are both your problem in an incident, whatever the internal org chart says. 

Check management interfaces specifically. They are the highest-value, least-patched category, and they are rarely in scope for a process designed around servers. 

The reason external attack surface review is worth doing before deeper testing is sequencing rather than sophistication.

Testing an application thoroughly is valuable, and it is wasted effort if the same organisation has a forgotten management interface published on an address nobody remembers.

The cheap enumeration comes first because the findings it produces are usually the ones that matter most and cost least to fix. 

Solusec is a UK cyber security practice based in Shropshire, holding CREST company accreditation for penetration testing alongside CREST’s AI-Enabled Penetration Testing accreditation. Testing is carried out by CREST-registered testers, remotely and on site, for organisations across the UK.