What counts as your external attack surface

Your external attack surface is everything that answers a connection from the public internet and can be traced back to you. Not what is in the inventory spreadsheet, not what is in Terraform, not what the architecture diagram shows — what answers, today.

Those lists overlap. They are never the same list, and the difference is where incidents come from.

The parts people count

Most teams can name these without help:

• Web applications and APIs on their primary domains.
• The mail, DNS and VPN endpoints published for the company.
• Whatever the cloud load balancers front.

This set is documented, monitored and usually patched. It is also the set an attacker spends the least time on, because everyone else has already looked at it too.

The parts that get missed

Subdomains nobody retired. Staging environments, a demo tenant from a customer trial, old. and legacy. and test. — DNS records outlive the infrastructure behind them constantly. When the backing resource is released and the record is not, someone else can claim it.

Non-standard ports on hosts you do know about. An inventory entry for a web server is not an inventory of what that host is listening on. Management interfaces, metrics endpoints and container control planes live well outside the top 1000 ports — the reason a full-range sweep finds things a quick scan does not, and the reason some ports should never face the internet.

Cloud resources with their own public addresses. Object storage with a public endpoint, a managed database with public access left enabled, a serverless function URL, a container registry. Each of these gets a public address from the provider without ever passing through the load balancer you think of as "the edge".

IPv6. A host can be firewalled correctly on IPv4 and completely open on IPv6, because the rule was written once, for one address family, years ago.

Acquisitions and second brands. The domains that came with a company you bought are your attack surface from the day the deal closed, whether or not anyone has added them to a scanner.

Third-party hosts on your name. A marketing microsite on someone's agency account, a status page, a documentation host. They carry your domain, and a compromise there is your incident.

Why an inventory cannot be the source of truth

An inventory records intent: what was meant to exist, as understood by whoever last edited it. An external scan records fact: what answers right now. Every process that widens the gap between them — a console change outside Terraform, a rebuilt host in the wrong security group, a contractor's demo box — moves exposure into the space the inventory does not describe.

So the discovery direction matters. Starting from the inventory and checking each entry can only ever confirm or deny things you already listed. Starting from your domains and address ranges and asking what resolves and what answers finds the entries that were never made.

Making the list a live one

A useful external attack surface is a scan result, not a document: enumerated from your verified domains and ranges, swept across the full port range and both address families, on a schedule, and — critically — diffed against last time. A snapshot tells you what is open. Only a diff tells you that something opened, which is the signal that arrives before anyone knows whether the service behind it is vulnerable.

CyberSpec runs scheduled external scans against domains, IPs and CIDR ranges you have verified ownership of, and tracks the result set per asset over time so new exposure registers as a change. See network scanning.