Every business has a front door on the internet. Most owners know about the obvious one: the website. But there are usually a few side doors too, and those are the ones attackers look for first.
An External Attack Surface Risk Assessment is a way to see all of those doors from the outside, the same way a criminal would, before a criminal does. Here’s what it is, what it looks at and who should get one.
What is your “attack surface”?
Your attack surface is everything about your business that can be reached or learned from the internet. For a typical 10 to 50 person office, that includes:
- Your domain names and when they expire
- Your email setup, including whether others can easily send email pretending to be you
- Your website and the software it runs on
- Remote access: VPN portals, remote desktop, firewall login pages
- Forgotten things: an old server, a test site, a domain you stopped using
- Leaked logins: usernames and passwords tied to your domain that are already for sale on the dark web
None of these are a problem on their own. They become a problem when they’re forgotten, out of date or wide open.
A real example from the Eastern Shore
We recently came across a local accounting firm that had moved to a new domain name a while back. Smart move. But nobody renewed the old one, and earlier this year someone else registered it. The firm’s own website still listed email addresses at the old domain.
Think about what that means. A client who looks up the firm’s contact info and emails a tax document to the address on the website could be sending it to a stranger. No one hacked anything. A renewal just slipped through the cracks, and it’s exactly the kind of thing an outside-in assessment catches.
What the assessment looks at
Working with our security partner VigilAiGent, we look at your business from the outside only. Nothing gets installed on your computers, and your team won’t notice anything. We check:
- Dark web exposure. Are logins with your business email domain showing up in breach data or for sale?
- Exposed services. Is anything reachable from the internet that shouldn’t be, like a remote desktop port or a firewall admin page?
- Email protection. Is your domain set up so it’s hard for scammers to send email that looks like it came from you?
- Domains and certificates. What do you own, when does it expire, and is anything out of date?
- Your website. Is the software current, or is it running something with known problems?
What you get
You get a written report, and more importantly, a conversation. I sit down with you, walk through what we found in plain English and give you a short, prioritized list: what to fix this week, what can wait and what isn’t worth worrying about. No 80-page PDF that sits in a drawer.
Who should get one?
- CPA and financial firms, especially before tax season. The FTC Safeguards Rule already expects you to assess your risks as part of your written security plan. (More on that in our WISP guide for Maryland CPAs.)
- Anyone who changed domains, email providers or IT companies in the last few years. Things get left behind.
- Offices with remote access for staff working from home.
- Anyone who has never looked. Most businesses haven’t, and that’s the point.
How it connects to the rest of your security
An assessment is a snapshot, not a shield. It tells you where the doors are. Keeping them closed is ongoing work: patching, monitoring, email security and making sure a stolen password alone can’t get anyone in. If you want to go deeper on the ongoing side, read what vulnerability management is or see how our cybersecurity services work for small businesses on the Eastern Shore.
Get your free assessment
We’re offering free External Attack Surface Risk Assessments to businesses in the Salisbury area and across Delmarva. All we need is your domain name (and your public IP address, if you know it; if not, we’ll help you find it).
Reserve your assessment or call us at (410) 219-2695.
