External attack surface: what the internet sees of your company

Because attacks do not pick names, they pick software versions. Bots crawl the internet non-stop looking for devices with known flaws.

• Pace of exploitation CISA, the US cybersecurity agency, publishes the KEV catalogue of flaws already used in real attacks and requires federal agencies to fix each new entry within two weeks.
• National trend In 2025 CERT.PT counted 3,864 incidents, a 40% rise on 2024, according to the CNCS.
• Human factor Nearly half of those incidents exploited people, with phishing as the dominant method.

It is a numbered channel through which a device accepts connections from outside. The website's port should be open. The firewall's admin console port should not.

Picture the company's building: main entrance locked and alarmed, but a side garage a supplier left unlocked years ago. There are search engines that catalogue every open port in the world, every day. The attacker is not looking for you; they filter the catalogue and find you.

• Device consoles ISP routers, firewalls, NAS, cameras and printers with their management page reachable from outside, exposed to serial password attempts or model-specific flaws.
• Unpatched remote access A VPN exists to face outwards. As soon as a manufacturer releases a patch, attackers analyse it and hunt for those who have not applied it; remote access devices appear frequently in the KEV catalogue. Learn why putting off updates is expensive.
• Published RDP Opening Windows Remote Desktop to make an accountant's life easier is one of the most sought-after invitations. Insist on a channel with identity verification; we explain why a VPN on its own is no longer enough.
• Orphaned subdomains Addresses such as test.company.pt or an old campaign's continue to point at decommissioned destinations, which a third party can sometimes take over with the company's brand. A domain that lapses drags the website and email down with it; see the risk of expired domains and certificates.
• Public email addresses They are on the website, on LinkedIn and in leaks from other services. They cannot be erased, but they can be mapped, and no account should rely on a password alone.

It measures exactly what an attacker would see, with prior authorisation and a written report.

1. List: every exposed IP, domain and device gets an owner. Without an owner, it gets forgotten.
2. Close: anything with no reason to be open is shut; consoles only via the internal network or VPN; remote access only with MFA.
3. Patch: firewall, VPN and router firmware kept current, with a fixed deadline for critical patches; equipment without vendor support is replaced.
4. Monitor: every new link or service changes the map; external checks at least monthly and an automatic alert for any new port.

DataRoad, under contract. The managed firewall, patching and alert monitoring are part of the IT Unlimited managed services. IT Unlimited Premium also includes on-site support, decisive when obsolete equipment has to go.

In 11 years, DataRoad has never suffered a security incident.

With a single way in, kept up to date under contract. The goal was to lock down the office, give the team encrypted remote access and keep work going if the internet went down.

• Perimeter Next-generation firewall with intrusion prevention and reports with alerts.
• Access SSL VPN through to the internal servers.
• Continuity Two internet circuits with automatic failover.
• Maintenance Firmware, rule tuning and VPN stability within IT Unlimited.

Details in the FreshDesign case study.

In 5 working days we map IPs, services, firewall, VPN, domains, subdomains and email, and deliver priorities ranked by risk. Request a no-commitment proposal.

More than 10 workstations · support contract · remote, on-site and telephone support. Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.

• CISA KEV catalogue
• CISA BOD 22-01 directive, remediation deadlines
• Lusa/DNoticias: CNCS figures for 2025