In this article
Your external attack surface is everything your company exposes on the internet that anyone can see and try to open without setting foot in the office: open ports, management panels, VPN, firewall, domains, subdomains and email addresses. In most companies it is larger than the board imagines. Reducing it is ongoing work — inventory, closing, updating and monitoring — and it is part of managed cybersecurity.
Why this matters now
- Attacks are automated Programs scan the internet for equipment with known flaws; the size of the company does not come into it.
- Flaws are exploited quickly CISA, the US cybersecurity agency, maintains the KEV catalogue of vulnerabilities already being exploited and requires federal agencies to fix new ones within two weeks.
- Incidents are rising in Portugal CERT.PT recorded 3,864 incidents in 2025, 40% more than in 2024, according to CNCS data.
A simple picture: the doors of the building
The company's front door has a lock and an alarm. But there is also the back door, and the garage a supplier used three years ago. The attack surface is the full set of entrances, including the forgotten ones.
In the digital world, a door is a numbered channel through which a device accepts connections. The website's door is open on purpose; the door to the firewall or server management panel should not be open to the world. There are search engines that list every open port on the planet every day. The attacker is not looking for your company: they filter the list.
The five most common exposures
Visible administration panels
Carrier routers, firewalls, NAS units, CCTV cameras and printers all have management pages. Reachable from the internet, they invite repeated password attempts or the exploitation of known flaws in that model.
Firewall and VPN not kept up to date
A VPN, by its nature, faces the internet. When a manufacturer publishes a fix, attackers study it and look for whoever has not yet installed it. Remote access devices appear regularly in the KEV catalogue, and CISA's two-week deadline is a good benchmark for any company. See why postponing updates costs dearly.
Remote desktop left open
Exposing Windows RDP directly, "just so the accountant can log in at the weekend", opens one of the most sought-after doors. Access should go through a VPN or a solution with identity verification; read why a VPN on its own is no longer enough.
Forgotten domains and subdomains
shop.company.pt, test.company.pt, the 2019 campaign: every subdomain points somewhere. If the destination was switched off and the record remained, a third party can, in some cases, take over the address under the company's name. And a domain that expires takes the website and email with it, as we explain in expiring domains and certificates.
Exposed staff email addresses
They appear on the website, on LinkedIn and in data leaks from other services. They cannot be hidden, but it is possible to find out which are most exposed and make sure no account relies on a password alone. According to the CNCS, around half of the incidents in 2025 exploited human vulnerabilities, with phishing at the top of the list.
What an external assessment checks
The measurement is taken from the outside, as an attacker would do it, but with authorisation and a final report.
| Element | Method | Warning sign |
|---|---|---|
| Public IPs | Internet contracts for each office and cloud services | Nobody knows how many there are |
| Open ports | Authorised scan of each IP | Panels, RDP, databases or shares visible |
| Firewall and VPN | Version identification and comparison with manufacturer advisories and the KEV catalogue | Version with a known, exploited flaw |
| Subdomains | DNS and public certificate logs | Addresses pointing to decommissioned services |
| Domains and certificates | Expiry dates and registrant | Registered in the name of a former employee or old supplier |
| SPF, DKIM, DMARC and data leaks | A domain anyone can impersonate |
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
Four steps to reduce exposure
- Inventory — public IPs, domains, subdomains and exposed equipment, each with an owner. What has no owner gets forgotten.
- Closed by default — whatever does not need to be open is closed; panels only via the internal network or VPN; remote access always with MFA.
- Update what remains — firewall, VPN and routers kept current, with a set deadline for critical fixes; equipment no longer supported by the manufacturer is replaced.
- Monitor continuously — the surface changes with every new device or service; checks at least monthly, with alerts for new ports.
At DataRoad, the managed firewall, updates and monitoring with alerting are included in our IT Unlimited managed services. On the Premium plan, on-site support is also included — useful when old equipment needs replacing.
Real case: FreshDesign with remote access through a single path
FreshDesign needed to protect its office, give the team secure remote access and keep working if the internet failed. DataRoad installed a next-generation firewall with intrusion prevention and alert reporting, set up an SSL VPN for encrypted access to internal servers and configured two internet connections with automatic failover.
Maintenance was placed under the IT Unlimited contract: firmware, policy tuning and VPN stability. One controlled path, updated by contract rather than "when there is time". Read the case FreshDesign: firewall and VPN.
Frequently asked questions
Is a small company really a target?
Yes. Most attacks on the external surface are automated and look for vulnerable software versions, regardless of company size.
Can testing the attack surface cause problems?
A well-run external check is discreet and agreed in advance. It identifies what is visible and in which version, without trying to get in; more intrusive tests are scheduled with the company.
How often should we check?
At least monthly, and whenever something changes: a new office, a new connection, a new cloud service or a new firewall. Ideally, continuous monitoring with alerts.
Doesn't the internet provider take care of this?
Usually not. The provider delivers the connection and sometimes the router; what stays open and up to date is the responsibility of the company or whoever manages its infrastructure.
Ask for a map of your attack surface
Within 5 working days we survey what the internet sees of your company — IPs, ports, firewall, VPN, domains, subdomains and email — and deliver a report with risk-based priorities. No-obligation proposal. More than 10 workstations · support contract · remote, on-site and telephone support.
+351 211 459 950* · sales@dataroad.pt
*Call to a Portuguese landline.
