External Exposure Analysis
See your organisation the way an attacker does, then know exactly what to fix first.
Attackers only need what is public.
Forgotten subdomains, old systems, expired certificates and services left open to the internet are easy for attackers to find. Most organisations have more of these than they realise, because nobody has looked at the business from the outside in.
The External Exposure Analysis does exactly that. We map what your organisation exposes publicly, pick out the high and critical risks, and walk you through what to fix first.
How it works
Three steps, from discovery to a clear plan of action.
We map everything you expose publicly
Domains, IP addresses, servers, certificates, open ports and known vulnerabilities, using passive and non-intrusive analysis of public-facing assets only.
We focus on high and critical risks
Rather than handing you a long list of minor issues, we cut through the noise to the exposures that matter most.
Clear findings. Practical fixes.
A guided session to walk through the results, a clear risk summary and practical remediation guidance you can act on.
What we analyse
- 01Domains & subdomainsIncluding forgotten, legacy and staging sites.
- 02Public IP addressesThe internet-facing footprint of your organisation.
- 03Web & mail serversConfiguration and software versions on public services.
- 04TLS & certificatesExpired, weak or misconfigured certificates.
- 05Open ports & servicesServices reachable from the internet that should not be.
- 06Known vulnerabilitiesExposed software with publicly known weaknesses.
Passive and non-intrusive. Public-facing assets only.
The kind of risks we find
- CriticalRemote desktop open to the internet
- CriticalUnpatched VPN appliance
- HighOutdated CMS with a known vulnerability
- HighOrphaned domain open to takeover
What you get
- A guided results session: what is exposed, why it matters and how it could be exploited
- A clear risk summary: where the biggest risks sit and what needs attention first
- Practical remediation: guidance you can act on, whether or not you work with us
- Free, with no obligation to work with us afterwards
Who it is for
- Organisations that have never looked at themselves from the outside in
- IT and security leaders who need a quick, evidence-based view of risk
- Businesses that have grown through acquisition or rebranding
- Teams preparing for a customer security review or audit
- Boards asking for a clear picture of cyber exposure
Apply for your free External Exposure Analysis
Tell us which domain you would like us to look at and we will be in touch within two working days to confirm the scope and arrange your results session.
Frequently asked questions
Is the analysis really free?
Yes. There is no cost and no obligation to work with us afterwards. The remediation guidance is yours to act on however you choose.
Will the analysis affect our systems?
No. The analysis is passive and non-intrusive, and covers public-facing assets only. We do not log in to anything or run tests designed to disrupt your services.
Do you need access to our systems?
No. We only look at what is already visible from the internet, which is exactly what an attacker would see.
What happens after I apply?
A member of our team will contact you within two working days to confirm the domains in scope. Once the analysis is complete, we arrange a guided session to walk you through the findings.
Is this the same as a penetration test?
No. It is an outside-in view of your public exposure, not an active test of your defences. If the findings point to the need for deeper testing, we can talk you through the options.
Need help beyond the analysis?
From security posture assessments to hands-on remediation, tell us what you are trying to achieve and we will recommend the right capability and delivery model.
Discuss your project