Almost every company believes it knows what it has exposed on the internet: its website, its email, perhaps its product. The mental list is short and tidy. The real list rarely is, because it includes things that were spun up and never taken down, services someone stood up for a demo, and credentials that ended up somewhere they should not be. The external attack surface is that real list, and seeing it the way an attacker does is usually a surprise.
What the external attack surface is (and why it doesn't match your inventory)
The external attack surface is the set of every point of your organisation reachable from the internet: domains and subdomains, IP addresses, open services and ports, APIs, certificates, access panels, and any data or credential of yours published outside.
The key point is that it does not match the inventory your team maintains. The inventory records what the company knows it has; the attack surface records what is actually exposed, whether anyone knows it or not. The gap between those two lists is precisely where most incidents happen: in the asset nobody was watching because nobody remembered it existed.
What is usually exposed without anyone knowing
Without resorting to alarming figures, these are the findings that appear again and again when a company's external surface is examined:
- Forgotten subdomains, pointing at old services or providers no longer in use.
- Staging or pre-production environments published for a demo or a deployment and never taken down, often with less protection than production.
- Orphaned cloud storage: a bucket from a finished project, with data inside and permissions left too open.
- Expired or misconfigured certificates, which beyond breaking trust flag unmaintained services.
- Admin panels reachable from the open internet, when they should sit behind a VPN or be IP-restricted.
- Leaked credentials and secrets in public code repositories or in third-party data dumps.
- Deprecated APIs and services that still respond even though no one maintains them.
None of these findings requires a sophisticated attack to discover: they are in plain sight to anyone who knows where to look.
Why CVSS alone isn't enough to prioritise
When dozens of findings appear, the usual reaction is to sort them by CVSS score and start with the "criticals". It is a common mistake. CVSS measures the technical severity of a vulnerability in the abstract, not the risk it poses in your context.
A medium-severity vulnerability on an admin panel reachable from the internet is more dangerous than a critical one on an internal service nobody can reach. Real risk combines three things: exposure (can it be reached from outside?), exploitability (is it easy to exploit, and are there known exploits?) and business context (what sits behind the asset?). Prioritising by real risk, rather than by CVSS alone, is what stops you spending the first week on what matters least.
The layer compliance doesn't cover
Here is the honest point. A compliance platform documents that you have controls and policies; it does not continuously watch what is exposed on your perimeter right now. You can hold a valid certificate and, at the same time, have a forgotten subdomain serving an open admin panel. It is one of the clearest examples of what a compliance platform does not do. It is no accident that enterprise security questionnaires ask about this directly: attack surface management, continuous scanning, time to detect new assets — questions a certificate does not answer on its own.
How to see what you have exposed right now
Seeing your surface the way an attacker does is a concrete, repeatable exercise:
- Enumerate your domains and discover every associated subdomain, not just the ones you use.
- Review which services and ports respond from the internet, and which should not.
- Inventory your cloud storage and its permissions; close anything orphaned.
- Check the status and validity of your certificates.
- Search for your own leaked credentials and secrets in public repositories and third-party breaches.
Above all, do it continuously. The surface changes every week: every deployment, every certificate that expires, every new subdomain alters it. A one-off analysis goes stale almost as fast as it is delivered — which is why the discipline is called attack surface management, not attack surface audit.
See your surface the way an attacker does
Discovering all of this once is useful; keeping it watched is what prevents the surprise. Qalea operates attack surface management continuously as part of its infrastructure layer: it discovers exposed assets — including the forgotten ones — watches for leaked credentials, and prioritises each finding by real risk, with a remediation plan rather than a list of CVEs sorted by CVSS. It is, moreover, the layer a compliance platform does not touch and the one your customers ask you about directly.
Start by seeing what you have exposed today.
