ESSENTIAL GUIDANCE · ASSET DISCOVERY · 10 min read
Part of Expose insights →External attack surface discovery: how to find internet-facing assets you do not know about
A practical guide to discovering unknown internet-facing assets, validating ownership and turning an outside-in inventory into accountable action.
External attack surface discovery starts with the domains, address ranges, certificates, cloud services and suppliers you already know, then follows public evidence to identify related internet-facing systems. The result is not automatically a trusted asset register: every candidate needs ownership, purpose and risk context before the organisation acts on it.
Need an acronym translated?Open the cyber glossary →Start with known roots and accountable owners
Begin with the organisation's registered domains, public IP ranges, cloud tenants, brands, subsidiaries and externally delivered services. Record who supplied each starting point and who can confirm ownership. A useful discovery process can expand beyond the existing inventory, but it still needs an accountable route for accepting, rejecting or investigating every candidate asset.
Use several external signals rather than one inventory
Public DNS, certificate-transparency records, routing and address information, web technologies, hosting relationships and other internet-visible metadata can reveal related services. No single source is complete, and a shared provider or reused technology does not prove ownership. Combining signals improves coverage while preserving the need for validation.
Look for the assets normal registers miss
Acquisition domains, campaign sites, development hosts, old customer portals, temporary cloud services and supplier-managed systems often sit outside the main configuration database. Search around brands, business units and historic infrastructure as well as the primary corporate domain. The objective is to surface plausible candidates, not to inflate the inventory with weak associations.
Validate attribution before assigning risk
Treat discovery as a hypothesis until ownership is confirmed. Check registration and hosting context, current DNS relationships, certificates, application branding and internal records, then ask the likely service owner. Mark uncertain, shared and third-party assets separately. A finding on infrastructure that merely resembles the organisation should not be presented as an owned vulnerability.
Add purpose exposure and ownership context
For confirmed assets, record the service purpose, business owner, technical owner, environment, internet reachability, authentication route, technology, data sensitivity and dependencies. This converts a list of hosts into a working external inventory. It also helps distinguish an expected public service from an accidental exposure or an asset that should have been retired.
Monitor change rather than relying on a snapshot
Internet-facing estates change through releases, cloud provisioning, supplier activity, certificates, DNS changes and acquisitions. Repeat discovery and compare results so new assets, changed services and disappeared hosts enter a review workflow. Monitoring should support ownership and remediation; it should not become a growing queue of unverified alerts.
Prioritise verification and containment
Investigate assets that combine public reachability with unclear ownership, sensitive functions, remote access, legacy technology or evidence of unintended exposure. Confirm the facts, assign an owner and choose an appropriate action: contain, update, retire, accept or investigate further. Numerical severity alone cannot explain business importance or whether an external observation is exploitable.
Keep passive visibility separate from active testing
Outside-in discovery can observe public information and externally visible services, but it does not authorise scanning, exploitation or testing of every system it identifies. Active testing requires explicit written permission from the relevant system owner. Supplier-managed and other third-party assets need their own authority and rules of engagement before technical testing begins.
Measure whether discovery improves control
Useful measures include unknown assets brought under management, time to validate ownership, time to assign material exposure, recurrence after closure and the proportion of confirmed assets with an accountable owner. Asset counts alone can reward noise. The aim is a current, defensible view that leads to verified action.
This guide covers the essentials. Continue into our technical analysis for a firmer position, practical implications and recommended action.
Read “Vulnerability remediation needs an operating model—not another spreadsheet” →
