Cybersecurity assessment
External attack surface assessment from passive public sources.
Active testing runs only on request, with written authorization.
An external attack surface assessment maps the services and assets a company exposes to the internet. Meo Advisors uses passive public sources to support external attack surface management, labels uncertain ownership and separates exposure from proven vulnerabilities. Scans and active testing need written authorization. The output is an evidence map and a prioritized risk register.
In short
- The external attack surface is the company’s internet-facing presence; a visible service is not proof of an exploitable weakness.
- Meo starts with passive public sources and records ownership questions, evidence dates and confidence.
- Port scans, vulnerability scans and penetration testing run only on request with written authorization.
What is attack surface management?
Attack surface management is the ongoing work of identifying a company’s exposed assets, assigning ownership and addressing supported risks. An external attack surface assessment establishes a scoped view of that internet-facing presence and records the questions it cannot resolve from outside.
An external attack surface is everything a company exposes to the internet that an attacker could reach.
Meo’s assessment starts with passive public sources. The cybersecurity due diligence hub connects those observations with the wider risk review and the checks that need written authorization.
What is the difference between attack surface and vulnerability?
An attack surface is the set of exposed places an attacker could reach. A vulnerability is a weakness that could be exploited; finding a public service does not establish that the service has an exploitable weakness.
| Concept | Question | Evidence boundary |
|---|---|---|
| Attack surface | What is exposed to the internet? | Passive sources can identify candidate assets and public observations |
| Vulnerability | What weakness exists? | The evidence must support the specific weakness being reported |
| Exploitability | What could an attacker actually do? | Active validation requires written authorization and an agreed scope |
What is an example of an attack surface?
A company’s public website, customer portal and internet-facing services are examples of its external attack surface. A related domain or certificate record can help identify a candidate asset, but ownership and current use still need confirmation.
- A public website and the customer-facing pages available at normal browsing rates.
- A portal hostname appearing in public DNS or certificate transparency records.
- An internet-facing endpoint reported in a third-party internet-scan dataset.
- Public certificate and security-header observations tied to a dated source.
These are examples of review categories, not findings about a company. A third-party record may be stale, and a linked service may belong to a vendor rather than the target.
What are the different types of external cyber risks?
External cyber questions include unintended public exposure, unclear ownership, certificate or security-header issues, and dependencies on public services. Passive evidence can flag these questions, but it cannot establish every internal weakness or the impact of exploitation.
- An administrative interface or service that appears public and needs an owner to confirm its intended exposure.
- A domain or endpoint whose ownership, purpose or current status is unclear.
- Certificate or security-header observations that need review in their application context.
- Shared infrastructure or templates that may repeat a supported issue across public properties.
Record an observation at the confidence the source supports. Avoid turning an exposed endpoint into a claim of compromise or a missing record into a failed control.
What is passive versus active external testing?
A passive review uses public records, third-party datasets and public pages at normal browsing rates. Active testing interacts with systems to probe their behavior; Meo runs that work only on request, with written authorization before it starts.
| Visible from outside | Needs authorized access |
|---|---|
| External exposure review | Penetration testing on request, with authorization |
| Internet-facing endpoints | |
| Certificates and security headers |
Before authorization we use passive public sources only: DNS, certificate transparency, third-party internet-scan datasets, and the target’s public pages at normal browsing rates. No port scans, vulnerability scans or login attempts without written authorization.
The assessment does not perform port scans, vulnerability scans or login attempts before written authorization. Reading an existing third-party dataset is distinct from initiating a new scan against the target.
When does a scan need written authorization?
In Meo’s work, port scans, vulnerability scans and other active testing require written authorization before they begin. The written scope must identify the systems, permitted activity, timing, responsible contacts and stop conditions.
Requests for external vulnerability scanning or an external vulnerability assessment therefore start with scope and authorization. Public accessibility and a sponsor’s interest in the company do not grant permission to test its systems.
How does a passive external attack surface assessment run?
The assessment starts with agreed public properties, collects passive evidence, checks what the sources support and ranks the resulting findings. Unconfirmed assets and internal-control questions stay visible as open questions.
- Agree the company names, known domains and business question in scope.
- Review public DNS, certificate transparency, third-party internet-scan records and public pages at normal browsing rates.
- Record source dates, candidate ownership and uncertainty before ranking any finding.
- Assign supported findings and open questions to the company owners who can resolve them.
| Layer | What we check |
|---|---|
| Marketing & Digital Visibility | AI answers and search ranking; Listings and reviews; Paid media; Pricing |
| Technology & Infrastructure | Technical debt; Vendors and SaaS subscriptions; Tags and measurement; Page speed |
| Cybersecurity | External exposure review; Internet-facing endpoints; Certificates and security headers; Penetration testing on request, with authorization |
Penetration testing in the cyber layer is a separate authorized activity, available only on request with written authorization.
What does the external assessment deliver?
The assessment delivers a sourced external inventory, supported exposure findings and an access request list for unresolved questions. Each risk retains the evidence, confidence and owner needed to decide what should happen next.
| Risk | Likelihood | Impact | Owner |
|---|---|---|---|
| Lead-form consent wording | High | High | Marketing lead |
| Exposed admin login | Medium | High | IT lead |
Use the cybersecurity due diligence checklist to carry the access boundary into the next review. The sample diligence deliverables show how findings and open questions are handed over.
Meo Advisors Editorial writes and maintains this page. Its numbers are Meo Advisors’ own statements or cited external benchmarks, and every mock is labelled Illustrative. See the editorial policy and corrections process.