Attack Surface
Ask most teams when an attack starts and they describe something arriving — a scan, a phishing email, a failed login. Something in a log. That is the second phase. The first one is quieter, cheaper, usually more productive, and it never touches you at all.
The opening move of a real attack leaves no trace on your side, because it is done entirely with public records. Most of them are records you published deliberately.
Certificate transparency is a public, append-only log. Every certificate any authority issued for your domain is in it, searchable, permanently — including the one for staging.internal.yourcompany.com that somebody spun up at 11pm two years ago. Nobody has to guess your subdomains. They can read the list.
Passive DNS keeps records long after you change them: hosts you decommissioned, providers you migrated away from, and the valuable one — CNAMEs still pointing at cloud resources you no longer own. That last case is a subdomain takeover sitting there waiting for whoever checks first.
A hiring post for a senior engineer is a technology inventory with a salary attached. Framework, cloud provider, CI system, monitoring stack, occasionally the exact versions. Written by you, published on purpose, indexed forever.
Professional networks make reporting structure legible by design: who runs finance, who joined three weeks ago, who is covering while somebody is on leave. A new joiner on a payments team is the most reliable phishing target in any company, and they are trivial to find.
Public repositories carry more than code — internal hostnames in config examples, API endpoints in test fixtures, commit metadata, and occasionally a key that somebody removed in a later commit but not from the history, where it still lives.
SPF, DKIM and DMARC are public DNS records. They state which providers may send as you, and whether a forged message from your domain gets rejected, quarantined or delivered to the customer. A permissive policy is an open invitation, published at your own request.
None of it requires a single packet aimed at your infrastructure. There is nothing to detect, nothing to rate-limit, nothing to raise an alert. It is fast, it is free, and — the uncomfortable part — it is largely lawful, because every source is one you or a public authority chose to publish.
By the time a scanner finally does touch you, it is not exploring. It is confirming a shortlist that was built while you were asleep.
The pattern is consistent, and it is rarely the thing you have spent money hardening. The flagship product is tested, patched and watched. What gets found instead is the forgotten thing — a staging environment that was meant to be temporary, a vendor portal from a project that ended, a microsite for a 2023 campaign, a DNS record aimed at a storage bucket that was released years ago.
These all share one property: nobody owns them. So nobody patches them, and — this is the bit that matters — nobody remembers to put them in scope when the annual test is commissioned. They sit outside the test and inside the perimeter.
Search the public CT logs for your domain and read every single name that comes back. Expect surprises — everybody gets them. Anything you do not recognise is either yours and forgotten, or not yours at all, and both are worth an hour.
Whatever answers is live and in scope whether you meant it to be or not. Whatever points at a cloud resource you no longer control is a takeover risk, and it is the cheapest serious finding in this entire field.
Describe the role and the problems, not the exact versions and vendors. You can hire excellent engineers without publishing a bill of materials.
If the policy is p=none, anyone can send mail as your domain right now and it will land. Moving to quarantine and then reject is roughly a week of work and closes an entire category of attack against your customers.
Switching a server off is half the job. The record still pointing at where it used to be is the half that gets exploited.
This is not a state, it is a feed. Certificates get issued, projects end, people leave, and the inventory starts drifting the week after you finish it.
None of this is exotic tradecraft. It is a patient stranger with a browser and a free afternoon — and it is the standard opening of both a real attack and a competent assessment. The only difference between the two is which one gets there first.
Next step
A 30-minute call, then a scope document with what is in, what is out and what it costs. No obligation, and no charge for the conversation.
