What the internet sees of your company: the surface of attack explained

7 min read · DataRoad

The external attack surface Your company is the sum of everything anyone can see and try to open from the internet, without ever having to enter your office. The short answer to the question “what the internet sees of us?” is almost always: more than management thinks. An open management panel, a VPN that has been updated a year ago, an old subdomain that no one has ever turned off. Each is a door.

What exactly is the attack surface

Think about the company building. The main door has a lock and an alarm. But there is also the back door and the garage that a supplier used three years ago. The attack surface is the set of all entrances, including the forgotten ones.

In the digital world, these entries are internet-connected services. Some are necessary—email, website, remote access. Others were opened by mistake or omission.

The five entries we find most frequently

1. Exposed management panels

Operator routers, firewalls, NAS (the network drives where many companies store files), video surveillance cameras, and printers all have management pages. When they become accessible over the internet, anyone can try password-based passwords or exploit a known flaw in this model.

2. Outdated VPN and firewall

A VPN is the tunnel that allows employees to work from home. By definition, it is turned towards the internet. Therefore, when a firewall manufacturer releases a security fix, attackers study it and start looking for devices that have not yet installed it. The CISA, the United States cybersecurity agency, maintains a public catalog of vulnerabilities that are already being exploited in practice — the KEV catalog — and remote access devices appear there regularly. For federal agencies, the rule is to fix every new vulnerability in the catalog within two weeks. That’s a good benchmark for any company. We explain the cost of delaying in the article Computer updates: “I’ll do it later” is expensive.

3. Direct remote access to the work environment

Opening the Windows Remote Desktop (RDP) environment directly to the internet, “just so the accountant can log in at the weekend,” is one of the most sought-after features. It must always go through a VPN or an identity verification access solution — see because the VPN alone is not enough.

4. Forgotten domains and subdomains

loja.empresa.pt, teste.empresa.pt, the 2019 campaign. Each subdomain points to a different site. If that site was shut down but the registration remained, a third party may, in certain cases, take over the address and serve content with your company’s name. And a domain that expires due to forgetfulness takes with it the website and email — we addressed this risk in domains and certificates that are about to expire.

5. Exposed email addresses

The team's emails appear on the website, on LinkedIn, and in data leaks from other services. It is not possible to hide them, but it is possible to know which ones are most exposed and ensure that no account depends solely on the password. The human factor weighs heavily: according to the CNCS, about half of the incidents recorded in 2025 exploited vulnerabilities related to people, with phishing being the main method.

How to measure: what an external diagnosis checks

It is measured from the outside, as would an attacker — but with authorization and a report at the end.

How to close: the plan in four steps

1. Inventory. List of public IPs, domains, subdomains and equipment connected to the internet, with a responsible person for each line. What has no owner is what gets forgotten.
2. Closing by omission. Everything that doesn't need to be open is closed. Management panels are only accessible via the internal network or via VPN. Remote access always goes through a channel with MFA (confirmation on the mobile phone in addition to the password).
3. Update what remains. Firewalls, VPNs, and routers with up-to-date manufacturer software, and a set deadline for critical fixes. Devices that the manufacturer has stopped supporting are replaced — there is no fix in sight.
4. Always be vigilant. The surface changes whenever someone installs equipment or contracts a service. The external verification should be repeated at least every month, with alerts when a new door appears.

At DataRoad, the managed firewall, Updates and alarm monitoring are part of the plans. IT Unlimited. No. Premium plan, On-site assistance is also included, which comes in handy when you need to replace an old piece of equipment.

A real case: firewall and VPN in FreshDesign

FreshDesign needed to protect the office network, provide secure remote access for the team, and not stop if the internet failed. DataRoad installed a next-generation firewall with intrusion prevention and reporting with alerts, created an SSL VPN for encrypted access to internal servers, and configured two internet connections with automatic failover to the second if the first fails. Maintenance was included in the IT Unlimited contract: firmware updates, policy tuning, and VPN stability. Read the full case study FreshDesign: firewall and VPN access.

The lesson: remote access via a single controlled channel, on equipment that someone updates on a contract basis — not “when there is time”.

Frequently Asked Questions

Is a small company really a target?

Yes. Most external surface attacks are automatic: programs that browse the internet in search of a model of equipment with a known flaw. The size of the company doesn't matter; the version of the software does.

Testing our attacking surface could ruin something?

A well-done external audit is discreet and coordinated in advance. It does not attempt to penetrate the systems; it identifies what is visible and in what version. The most intrusive tests, when they make sense, are scheduled with the company.

How often should we check?

At least once a month and whenever something changes: new office, new internet connection, new cloud service or change of firewall. The ideal is continuous monitoring with alerts.

Does the internet provider not deal with this?

Usually not. The operator delivers the connection and sometimes the router. What is open, what equipment is connected and whether it is up to date is the responsibility of the company or the person who manages their computer system.

Map of the external attack surface in 5 working days

We collect the information the internet sees about your company — IP addresses, ports, firewalls, VPNs, domains, subdomains, and email — and deliver a report with the priorities ordered by risk. For companies with more than 10 employees · contract support · remote and on-site support.

Sources

• CISA — Known Exploited Vulnerabilities (KEV) Catalog
• CISA — Binding Operational Directive 22-01 (correction deadlines)
• Lusa / DNoticias — CNCS data: 3,864 incidents in 2025, plus 40% more