--- title: "External attack surface | DataRoad IT" description: "Exposed admin panels, unpatched VPNs, RDP and forgotten subdomains: measure your external attack surface and close it. No-obligation proposal." language: en url: https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/ source: https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > Exposed admin panels, unpatched VPNs, RDP and forgotten subdomains: measure your external attack surface and close it. No-obligation proposal. # External attack surface: what the internet sees of your company At a glance For decision-makers short on time. - 01 The external attack surface is everything reachable from the internet: firewall, VPN, RDP, domains, email. - 02 Automated attacks hunt for vulnerable versions; company size does not matter. - 03 In 2025 CERT.PT recorded 3,864 incidents, 40% more than in 2024 (CNCS). - 04 Plan: list, close, patch and monitor every month, under an IT Unlimited contract. ### In this article A single exposed management panel can cost a company weeks of downtime and client data. The **external attack surface** is the set of services anyone can reach from the internet: firewall, VPN, remote access, domains, subdomains and email accounts. DataRoad measures it from the outside, closes what should not be open and keeps it under watch, as part of managed cybersecurity. ## Why is your company already being scanned? Because attacks do not pick names, they pick software versions. Bots crawl the internet non-stop looking for devices with known flaws. - **Pace of exploitation** CISA, the US cybersecurity agency, publishes the KEV catalogue of flaws already used in real attacks and requires federal agencies to fix each new entry within two weeks. - **National trend** In 2025 CERT.PT counted 3,864 incidents, a 40% rise on 2024, according to the CNCS. - **Human factor** Nearly half of those incidents exploited people, with phishing as the dominant method. ## What is an exposed port, in practice? It is a numbered channel through which a device accepts connections from outside. The website's port should be open. The firewall's admin console port should not. Picture the company's building: main entrance locked and alarmed, but a side garage a supplier left unlocked years ago. There are search engines that catalogue every open port in the world, every day. The attacker is not looking for you; they filter the catalogue and find you. ## Where are the most frequent leaks? - **Device consoles** ISP routers, firewalls, NAS, cameras and printers with their management page reachable from outside, exposed to serial password attempts or model-specific flaws. - **Unpatched remote access** A VPN exists to face outwards. As soon as a manufacturer releases a patch, attackers analyse it and hunt for those who have not applied it; remote access devices appear frequently in the KEV catalogue. Learn why [putting off updates is expensive](https://www.dataroad-it.com/en/patch-management-cost-of-delay/). - **Published RDP** Opening Windows Remote Desktop to make an accountant's life easier is one of the most sought-after invitations. Insist on a channel with identity verification; we explain why [a VPN on its own is no longer enough](https://www.dataroad-it.com/en/secure-remote-access-vpn-managed-firewall/). - **Orphaned subdomains** Addresses such as test.company.pt or an old campaign's continue to point at decommissioned destinations, which a third party can sometimes take over with the company's brand. A domain that lapses drags the website and email down with it; see [the risk of expired domains and certificates](https://www.dataroad-it.com/en/domains-dns-ssl-certificates-expiry/). - **Public email addresses** They are on the website, on LinkedIn and in leaks from other services. They cannot be erased, but they can be mapped, and no account should rely on a password alone. ## What does a DataRoad external assessment measure? It measures exactly what an attacker would see, with prior authorisation and a written report. | Target | Technique | Red flag | | --- | --- | --- | | Public IP addresses | Survey of each site's circuits and cloud services | The company does not know how many it has | | Open services | Authorised scan, IP by IP | RDP, consoles, databases or shares in plain view | | Firewall and VPN | Version detection, cross-checked against vendor bulletins and the KEV | Public flaw already exploited | | Subdomains | DNS queries and certificate transparency | Records for retired services | | Domains | Ownership and renewal dates | Registered by a former employee or supplier | | Email | SPF, DKIM, DMARC and breach databases | Anyone can impersonate the domain | ## How do you close the attack surface in four moves? - **List**: every exposed IP, domain and device gets an owner. Without an owner, it gets forgotten. - **Close**: anything with no reason to be open is shut; consoles only via the internal network or VPN; remote access only with MFA. - **Patch**: firewall, VPN and router firmware kept current, with a fixed deadline for critical patches; equipment without vendor support is replaced. - **Monitor**: every new link or service changes the map; external checks at least monthly and an automatic alert for any new port. ## Who does this work when there is no in-house security team? DataRoad, under contract. The [managed firewall](https://www.dataroad-it.com/en/managed-firewall-services-portugal/), patching and alert monitoring are part of the [IT Unlimited](https://www.dataroad-it.com/en/managed-it-services/) managed services. [IT Unlimited Premium](https://www.dataroad-it.com/en/it-unlimited-premium-on-site-support/) also includes on-site support, decisive when obsolete equipment has to go. In 11 years, DataRoad has never suffered a security incident. ## How was FreshDesign protected? With a single way in, kept up to date under contract. The goal was to lock down the office, give the team encrypted remote access and keep work going if the internet went down. - **Perimeter** Next-generation firewall with intrusion prevention and reports with alerts. - **Access** SSL VPN through to the internal servers. - **Continuity** Two internet circuits with automatic failover. - **Maintenance** Firmware, rule tuning and VPN stability within IT Unlimited. Details in [the FreshDesign case study](https://www.dataroad-it.com/en/freshdesign-ngfw-ssl-vpn-failover/). ## Questions managers ask us ### Is an SME of interest to an attacker? Yes. Scans are automated and look for vulnerable software, not large companies. ### Can an external check affect our systems? No, if it is properly conducted. It is agreed in advance and only observes what is visible and in which version; more invasive tests happen only by appointment. ### How often should we check? Every month, at a minimum, and after every change: new office, new circuit, new cloud service or firewall replacement. Better still: continuous monitoring. ### Isn't this the telecoms operator's job? No. The operator supplies the line and sometimes the router; what is open and up to date is the responsibility of the company or its IT partner. ## Want to see what the internet sees of you? In 5 working days we map IPs, services, firewall, VPN, domains, subdomains and email, and deliver priorities ranked by risk. Request a no-commitment proposal. **More than 10 workstations · support contract · remote, on-site and telephone support.** Call **+351 211 459 950 *** or write to sales@dataroad.pt. **Call to a Portuguese landline.* ## Sources - [CISA KEV catalogue](https://www.cisa.gov/known-exploited-vulnerabilities) - [CISA BOD 22-01 directive, remediation deadlines](https://www.cisa.gov/binding-operational-directive-22-01) - [Lusa/DNoticias: CNCS figures for 2025](https://www.dnoticias.pt/2026/4/28/490057-incidentes-de-seguranca-informatica-em-portugal-aumentaram-40-em-2025/) Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/)[Managed IT and cybersecurityManaged backup: the 30-minute restore test that proves itA backup never restored is a deferred risk. In 30 minutes, an old document, a deleted email and a server booted in isolation show whether th…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/managed-backup-30-minute-restore-test/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed cybersecurity ## One StepAhead of IT. Nobody notices security until the day it fails. That is why ours works every day: alerts handled, access reviewed, backups verified. - **M365** backed up off-site - **MFA** on every managed account - **Top 5%** SMEs · scoring.pt We do **IT** right. DataRoad IT Unlimited ## Does your IT depend on a single person? Documentation, inventory and one contact who answers for everything. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/