Your external attack surface is everything about your company that an attacker can see and potentially exploit from the internet without any insider access. For startups, this includes your website, mail servers, cloud infrastructure, leaked credentials, exposed API endpoints, third-party integrations, employee social media accounts, and any system that touches the public internet. Most startups have no idea how much of their attack surface is visible to attackers—and how much valuable information can be gathered with basic OSINT (open-source intelligence) tools. This gap between what you think attackers know and what they actually know is where breaches happen. In this guide, we'll walk through external attack surface analysis, the reconnaissance techniques attackers use, and how to harden your exposure before someone malicious finds your weak points.
What Exactly Is Your External Attack Surface?
Your external attack surface encompasses every digital asset your company owns or operates that's reachable from the internet. This includes obvious targets like your website and API endpoints, but also less obvious ones: forgotten cloud storage buckets, development environments exposed to the internet, employee GitHub accounts with sensitive data in commit history, exposed subdomains, forgotten services running on non-standard ports, and third-party tools connected to your infrastructure.
Startups frequently underestimate their attack surface because they think in terms of their primary application. A typical SaaS startup might have: the main product website, an admin dashboard, an API backend, multiple cloud storage buckets, documentation sites, internal development servers, email infrastructure, employee management systems, analytics platforms, and integrations with 10+ third-party services. Each of these is a potential entry point. And if you've been around for 18+ months, you almost certainly have forgotten assets: old development environments, abandoned product experiments, test instances that never got shut down, staging servers, or integration sandboxes.
Attackers identify your attack surface through passive reconnaissance—gathering information without actually attempting to break in. They use DNS enumeration to find your subdomains, WHOIS lookups to discover your infrastructure details, SSL certificate transparency logs to identify your services, GitHub searches to find your exposed code and credentials, employee LinkedIn profiles to understand your technical stack, and web scraping to capture information from your website. This reconnaissance costs them nothing and leaves no forensic trace. By the time you realize you've been breached, attackers have spent hours mapping your entire attack surface.
Reconnaissance Tools Attackers Actually Use
Understanding the tools attackers use helps you anticipate what they'll discover about your company. Let's walk through the most effective reconnaissance techniques and the openly available tools that power them.
DNS enumeration reveals your subdomains and infrastructure architecture. Tools like Subfinder, Amass, and Assetfinder automatically query public DNS databases, SSL certificate transparency logs, and search engines to identify every subdomain associated with your domain. A typical startup might find 15-50 subdomains—far more than the three or four they actually remember deploying. Many of these will be abandoned staging environments, legacy integrations, or development instances. Each is a potential attack vector. Run a quick enumeration using Subfinder: it's free, takes 2 minutes, and will reveal subdomains you didn't know were public.
SSL certificate transparency logs record every SSL certificate issued for your domain, including all subdomains and subject alternative names. This is public information designed to prevent certificate fraud, but it's incredibly useful for reconnaissance. AttackerFind this information using crt.sh or similar tools. You'll often find certificates for services you've decommissioned but forgot to stop renewing. Port scanning identifies which network ports on your infrastructure are open and accessible. Tools like Nmap and Shodan scan for open ports and identify services running on them. Many startups accidentally expose management consoles, databases, or internal tools on ports they assume are firewalled but aren't. A single exposed Redis instance or exposed Kubernetes API endpoint can compromise your entire infrastructure.
Credential scanning searches public code repositories, pastebin, GitHub, and other sources for exposed API keys, database passwords, and authentication tokens associated with your domain or company. This is devastatingly effective because developers regularly commit secrets by accident. A single leaked AWS access key can give attackers full access to your infrastructure. Tools like TruffleHog and GitHub's built-in secret scanning automate this, checking both public and (if you enable it) private repositories.
Taking Inventory and Prioritizing Remediation
Conduct your own external attack surface analysis before attackers do it for you. Start by enumerating your subdomains. Use Subfinder or Assetfinder to list every subdomain associated with your primary domain. Document which are legitimate, which are decommissioned but still running, and which shouldn't exist. Decommissioned services should be taken offline immediately. For subdomains you need to keep, ensure they're secured the same way as your primary application.
Run a vulnerability scan against each subdomain and web-facing service. Use free tools like Nessus (community version) or Qualys to identify obvious misconfigurations: unpatched software, weak SSL configurations, outdated frameworks, exposed admin panels. Prioritize anything marked "critical" or "high" severity. Check your cloud infrastructure for exposed buckets. In AWS, use AWS S3 Bucket Finder or similar tools to identify any S3 buckets associated with your domain. Ensure bucket policies restrict public access and enable encryption. The same applies to Azure Blobs and Google Cloud Storage buckets.
Scan for exposed credentials using GitRob or TruffleHog against your GitHub organization. Configure branch protection rules to prevent secrets from being committed going forward. Implement pre-commit hooks that block commits containing potential API keys or database passwords. Map your third-party integrations and verify that API keys used by external services are scoped appropriately—an email service shouldn't have access to your entire API.
Hardening Your Attack Surface
Once you've inventoried your attack surface, systematically reduce it. Shut down any service that's no longer needed. Each running service is security debt. If it's not actively serving customers or team needs, decommission it. For services you're keeping, implement network segmentation: internal tools and staging environments should not be publicly accessible. Use a VPN or private network for employee access. Enable authentication on every system that exposes data or administration capabilities. A forgotten development dashboard should not be accessible to anyone with the URL.
Implement proper monitoring and alerting for unusual access to your attack surface. Configure web application firewalls to block reconnaissance attempts and common attack patterns. Monitor for unauthorized subdomains or DNS changes using tools like DNSdumpster or Whois change notification services. The goal isn't to eliminate your attack surface entirely—that's impossible for any live service—but to eliminate surprise. You should know every system attackers can see, and you should have a plan for securing each one.
External attack surface analysis is a continuous process, not a one-time assessment. New subdomains get deployed, new integrations get added, and old services sometimes get forgotten. Running regular scans (monthly is reasonable for startups) keeps you ahead of the reconnaissance that attackers constantly perform. The cost of a thorough external attack surface assessment is minimal compared to the cost of a breach exploiting something attackers found that you didn't.
RedRadar's external attack surface analysis service identifies every publicly exposed asset associated with your company, tests them for common vulnerabilities, and prioritizes what needs fixing first. We've discovered dozens of critical exposures—from forgotten credentials to unauthenticated admin dashboards—that companies had no idea were public.
