Attack Surface Monitoring: What Attackers Know About Your Company
The short answer
Attack surface monitoring continuously checks what an attacker can find about your company from outside.
- What it shows: subdomains, open services, certificates, software versions, forgotten test systems and leaked credentials. All of it findable without a password.
- Why continuously: your attack surface changes with every release, every new cloud resource and every service provider. A one-off scan is out of date within weeks.
- What it is not: not a pentest and not a 24/7 SOC. It flags new risks early; the pentest examines them in depth.
- Start yourself: you can run the three checks further down in half an hour today.
FreeWhat does an attacker see of your domain? Two-page report in three business days, completely free and hassle-free.
Request the check →The question rarely anyone asks
How many subdomains does your company have? Most managing directors and IT leads we ask underestimate it. Not because they do not know their IT, but because the attack surface is not written down anywhere. It grows on the side: a test server for a project, a marketing agency’s landing page, a VPN login for a contractor.
An attacker does not need that list from you. They build it themselves from public sources in a few minutes. Attack surface monitoring turns this around: you see the same list first, every time something changes.
What an attacker finds without credentials
Everything on this list can be found from outside, without attacking a system.
Reconnaissance from outside
Four public sources, one list
- Certificate logse.g. crt.sh
- Device search enginese.g. Shodan, Censys
- DNS and websitesrecords, headers, error pages
- Code and data leaksrepositories, breach databases
The attacker's list
- www.your-company.exampleWebsiteknown
- shop.your-company.exampleOnline shopknown
- staging.your-company.exampleTest environment, publicforgotten
- test-2019.your-company.exampleCertificate expiredunmaintained
- vpn.your-company.exampleVersion with known flawcritical
- 203.0.113.17:3389Remote desktop open to the internetcritical
- github.com/…/configCredentials in the historycritical
Subdomains
Every TLS certificate is logged in public Certificate Transparency logs. Anyone searching them for your domain sees test., staging., vpn. and every other subdomain that ever had a certificate, including ones from years ago.
Open ports and services
Remote access, databases, admin panels: whatever is reachable from the internet is indexed by device search engines such as Shodan or Censys, often long before anyone inside notices.
Certificates
Expired or self-signed certificates show which systems nobody maintains anymore. To an attacker, that hints at where the updates are missing too.
Software versions
Many servers state their version in a header or on the error page. If that version has a known vulnerability, the attacker’s next step is automated.
Forgotten test systems
The demo for a customer, the old staging environment, an agency project: systems nobody tracks anymore often have weak passwords and real data.
Public repositories and leaks
Code on GitHub with credentials in its history, employee passwords from other companies’ data breaches. Both can be found from outside without touching a single one of your systems.
Why a one-off scan is not enough
One pentest a year, 50 releases in between. In that time new systems appear, and others are forgotten without being switched off.
One year in your IT
What happens between two pentests
- 1MarchNew subdomain staging2 for a client projectAnnual pentest:in December, after 9 monthsMonitoring:✓ on the next run
- 2JuneRemote access opened for a service providerAnnual pentest:in December, after 6 monthsMonitoring:✓ on the next run
- 3SeptemberCertificate of the old test site expiresAnnual pentest:in December, after 3 monthsMonitoring:✓ on the next run
- 4OctoberCritical flaw in your VPN software goes publicAnnual pentest:in December, after 2 monthsMonitoring:✓ on the next run
Where the new entries come from:
New releases
A new API, a port opened for debugging, an admin page that was only meant to be online “for a moment”.
Cloud resources
In the cloud, a publicly reachable storage bucket or database is set up in minutes. Making it public is often a checkbox nobody reviews later.
Service providers
Agencies, hosters and software partners run systems under your name. To attackers they are part of your attack surface, no matter who manages them.
On top of that come new vulnerabilities in software you have run for years. When a critical flaw is published, automated scans often start within hours. What matters then is whether you know in minutes which of your systems are affected, or only after days.
Monitoring and pentest: breadth and depth
Breadth and depth
Two tools, two directions
Monitoring
Everything reachable from outside. Continuous, but only the surface.
Pentest
An agreed scope, down into authenticated areas and the logic.
Together
Monitoring shows where it pays off, the pentest goes deep there.
| Attack surface monitoring | Penetration test | |
|---|---|---|
| Key question | What is reachable from outside, and what is new? | What of it can be exploited? |
| Timeframe | Continuous | One point in time |
| Depth | Breadth: everything attributable to you | Depth: an agreed scope, including logged-in areas |
| Intrusion | None, only public sources and reachability | Active testing with separate authorisation |
| Our prices | First check free, monitoring from €249 per month | From €3,500, fixed price after scoping |
Both belong in a loop we call the Security Cycle.
Security Cycle
Monitoring is the first step of the cycle
- You are here01SeeAttack surface monitoringFree check, from €249/month
- 02TestPenetration testfrom €3,500
- 03AttackRed teamingStarter €2,500
- 04SecureSecurity audit€2,500 (2 days)
New releases, new systems: the cycle starts over.
The difference between testing and attacking is explained in Red Teaming vs. Penetration Testing, what a pentest costs in Penetration Testing Costs 2026.
What good monitoring delivers
Changes, not endless lists
Monitoring that reports the same inventory every day is ignored after two weeks. What gets reported is what is new: a new service, a new subdomain, a new hit in a data breach.
Prioritised by a human
Tools produce false positives and systems that do not even belong to you. Before you see a finding, a person on our side reviews it and tells you what to do first.
Clear ownership
A finding without an owner stays open. Our platform module DevShield assigns systems to the teams responsible for them and tracks the status of every finding. To be clear: DevShield is in Early Access, and part of the analysis still runs with support from our analysts.
Changes since the last run
your-company.example
- Highnew203.0.113.17:3389
Remote desktop (RDP) reachable from the internet
Recommendation: Close it or allow VPN access only · Owner: IT operations
- Mediumnewstaging2.your-company.example
New subdomain with a public login page
Recommendation: Check whether it has to be public · Owner: Web team
- Lownewtest-2019.your-company.example
Certificate expired
Recommendation: Shut down or renew · Owner: Web team
Start yourself: three checks for today
You need no tool and no provider for these. Only check your own domains.
- 1
Subdomains via Certificate Transparency
Open crt.sh and search for
%.your-domain.com. You see every subdomain a public certificate was issued for. Go through the list: do you know every entry? Is the system still running, and does anyone still need it? - 2
Is there a security.txt?
Open
https://your-domain.com/.well-known/security.txt. The file tells security researchers where to report a vulnerability they found (RFC 9116). Without it, a report ends up in the general inbox or nowhere. For manufacturers, a reporting contact is required anyway under the Cyber Resilience Act. - 3
Expired certificates
Open the subdomains from step 1 in your browser. Every certificate warning points to a system nobody maintains. These systems either go back into maintenance or get switched off.
If the list is longer than expected, or you are not sure what an entry means, we are happy to take a look. The free attack surface check does the same, only more thoroughly: automated discovery, manual review and a two-page report for one domain within three business days, without a contract and without access to your systems.
What it costs with us
Deeper
Basic Check
€199 one-off
Several domains, data breach matching, platform access. Credited towards monitoring.
Ongoing
Monitoring
from €249/month
Basic €249 (one domain, monthly), Pro €599 (up to five domains, weekly).
All prices net. Behind the monitoring is our security team of four experts in Germany and Vietnam. All details are on the attack surface monitoring page.
What we do not offer
No 24/7 SOC. We monitor your attack surface from outside and report changes. We do not take on round-the-clock monitoring of your internal systems with a response commitment.
No incident response retainer. If there are signs of a breach, we inform you immediately and refer you to a specialised incident response provider.
And no guarantee that nothing is missed. Monitoring makes visible what is reachable from outside. Whether it can be exploited, only a pentest shows.
Frequently asked questions about attack surface monitoring
What is attack surface monitoring?
Attack surface monitoring (also called External Attack Surface Management, EASM) continuously checks what an attacker can find about a company from outside: subdomains, open services, certificates, software versions and leaked credentials. It reports changes, so new risks surface before someone exploits them.
How is attack surface monitoring different from a penetration test?
Monitoring covers breadth: it shows continuously what is reachable. A penetration test covers depth: at one point in time it tests what of that can be exploited. Monitoring does not replace a pentest, but it makes sure nothing new appears unnoticed between two tests.
Do you need access to our systems?
No. Monitoring works from outside only, using the same public sources attackers use. There is nothing to install. We only check systems that belong to you, and only after your written order.
How much does attack surface monitoring cost?
The first attack surface check is free. A Basic Check with platform access costs a one-off €199 and is credited towards monitoring. Ongoing monitoring costs €249 per month (Basic, one domain) or €599 per month (Pro, up to five domains, weekly).
Is this a Security Operations Center (SOC)?
No. We monitor your attack surface from outside and report changes. We do not offer 24/7 monitoring with a response commitment, nor incident response. If you need that, we say so openly and point you to suitable providers.
Free attack surface check
See what an attacker sees
Give us one domain. We map your attack surface from outside, review the findings by hand and send you a two-page report.
- ✓Forgotten subdomains, test servers and exposed services
- ✓Certificates, TLS and email security (SPF, DKIM, DMARC)
- ✓Accounts on your domain in known data breaches
- ✓The three most important next steps, in plain language
Request your free check
One domain is enough. Your report arrives within three business days.
Rather talk first?
