Everything a stranger can reach from the internet.
Your attack surface is every host, app, API and file you expose, whether or not anyone remembers exposing it. Attackers map it first. We'd rather you did.
Bigger than the list you were given.
An attack surface isn't a diagram. It's whatever answers when somebody on the internet knocks, including things nobody on your team would think to list.
Domains and subdomains
Every name in your DNS and every certificate ever issued for you. Certificate transparency logs make that list public, whether you read it or not.
Apps, APIs and admin panels
Customer portals, login pages, GraphQL endpoints, and the Grafana dashboard somebody opened for a demo. Each one is a door with its own lock.
Cloud and storage
Public addresses, load balancers, buckets and databases in AWS, Azure or GCP. One click in a console can make any of them public.
Suppliers and leftovers
The agency's campaign site on your domain, a vendor's portal, last year's migration server. Somebody else built it. It still gets attacked as you.
It changes without asking you. A new subdomain, a certificate issued this morning, a firewall rule loosened for a migration and never closed. A map drawn once is out of date within weeks.
You can't defend what nobody listed.
Plenty of incidents don't start with a clever exploit. They start with something reachable that nobody was watching.
Attackers start here
They read the same certificate logs and DNS records we do, automatically and all the time. Whoever maps your surface first gets the first try.
Your other tools depend on it
Scanners, your SOC and your patching all cover the assets they know about. A forgotten host sits outside all three at once.
Regulators ask for it
NIS2 and DORA both expect you to know and manage your ICT assets. "We didn't know it existed" is not an answer auditors accept.
Clean code can still be wide open.
Frontier models like Anthropic's Claude Mythos find bugs that hid in code for decades. SonarQube catches flaws on every pull request. Keep both.
Both answer one question: is this code safe? Attackers ask a different one: what is running out there, and can I get in? Code doesn't know where it was deployed, what configuration sits in front of it, or what else shares the domain.
| What's exposed | AI code reviewMythos-class models | Static analysisSonarQube and similar | FriendlyFlareFrom the outside, every week |
|---|---|---|---|
| A flaw in a repository you scan |
Covered: Its home ground |
Covered: On every pull request |
Partly: If it's reachable, we prove it |
| A staging copy deployed by hand |
Not visible: Never sees deployments |
Not visible: Not in the pipeline |
Covered: Found through DNS and certificates |
| A storage bucket made public in the console |
Not visible: Console settings aren't code |
Not visible: Console settings aren't code |
Covered: Found and tested from outside |
| An admin panel opened by a proxy or firewall rule |
Not visible: The rule lives outside the repo |
Not visible: The rule lives outside the repo |
Covered: Reached and proven |
| An app built in an AI app builder |
Not visible: No repository to point it at |
Not visible: No pipeline to gate |
Covered: Found like any other host |
| A supplier's host on your domain |
Not visible: Not your code |
Not visible: Not your code |
Covered: Mapped, and tested if it's in scope |
| Whether it can be exploited in production |
Partly: Reasoned about, not tried on production |
Not visible: A pattern match |
Covered: Request, response, screenshot |
This isn't a knock on code tools. Fix what they find, because it makes everything we test harder to break. We cover the part they can't see by design: what is deployed, where, and who can reach it.
Software now ships faster than anyone reviews it.
Anyone with a prompt can put a working app on the internet by lunch. That is genuinely useful. It also means your attack surface grows on days when nobody filed a ticket.
More builders, fewer reviews
Marketing, sales and operations now ship their own tools. Most of them have never seen a threat model, and nobody asked them to.
Deploys that skip the pipeline
One click in the app builder publishes straight to a hosting platform. The SonarQube gate never runs, because there is no pipeline to run it in.
The same mistakes, at scale
API keys in the front-end bundle, database rules left open, login checked only in the browser. Generated code repeats the patterns it learned from.
Nobody owns it next month
The person who prompted it moves on and the app keeps running. Forgotten apps used to take years to pile up. Now they take an afternoon.
So the question moves. "Is this code safe?" still matters. "What got deployed this week, and who can reach it?" now matters more. That question has no repository to scan. It only has an outside, and the outside is where we work.
Map it, prove it, keep it current.
You give us a company name and one domain. Everything below runs from there, with written authorisation first and nothing destructive, ever.
Map
Certificate logs, DNS, cloud ranges and code hosts. A named analyst removes what isn't yours, and you confirm the rest.
Prove
AI agents attack every agreed asset each week, read-only and rate-limited. A person signs off every finding before you see it.
Keep it current
The external map is redrawn every 3–7 days. New assets join the next attack run, and fixes are re-tested rather than taken on trust.
Start with the map. We draw it for free.
Give us a name and a domain. You get the first map, checked by a person, and you keep it whether or not you go any further.