Why the inventory is always wrong
Asset inventories describe intent. The internet describes reality. The gap between them opens through entirely ordinary events: a marketing campaign that needed a landing page, a staging environment stood up for a launch, an acquired company's DNS still delegating, a developer's proof of concept that outlived the developer.
None of that is negligence. It is the normal metabolism of an organisation, and it means the question "what do we expose?" has to be answered by looking rather than by asking.
Certificate transparency: the log you did not opt into
Every publicly trusted TLS certificate issued for your domains is recorded in public certificate-transparency logs. That system exists to catch misissuance, and it works. It also means that every hostname you have ever requested a certificate for is searchable by anyone, permanently.
This is the single richest source in discovery, and it is free. It routinely surfaces staging., legacy., vpn-test. and admin. hosts that no internal document mentions. If you have never looked at your own CT history, an hour with it will change your view of your perimeter.
The four questions that turn a list into a finding
Two hundred discovered subdomains are data. The work is reducing them to the handful that matter:
- Does it resolve? Dead names are noise — with one exception below.
- Does it answer? A resolving name with a live service is the real surface.
- What is it running, and how old is that? A forgotten host is dangerous mostly because nobody has patched it.
- Who owns it? The most common outcome of discovery is not a vulnerability but an ownership question nobody can answer, which is itself the finding.
The exception on dead names is subdomain takeover: a DNS record still pointing at a de-provisioned cloud resource can often be claimed by whoever registers that resource next, handing them a hostname under your domain — with your TLS, your cookies and your users' trust attached.
Origin-IP exposure: the CDN you are paying for and bypassing
Putting a CDN or WAF in front of an application only helps if the application cannot be reached without it. When the origin server's real address is discoverable — through historical DNS, a certificate covering the origin hostname, a misconfigured mail record, or an error page that leaks it — an attacker connects directly and every edge protection stops applying.
This is one of the most consequential findings in external discovery precisely because it silently invalidates a control you believe you have. Testing it is simple: try to reach the application by IP, with the right Host header, and see whether it answers.
Doing this without buying a platform
External attack surface management is a product category now, with pricing to match. The underlying signals are public, and a quarterly pass with free tooling puts most organisations ahead of where they are today:
- Search certificate transparency for every domain you own, including the ones you only redirect.
- Enumerate DNS thoroughly, then probe which names actually answer.
- Check whether your origin is reachable directly, for every service behind a CDN.
- Look for lookalike domains registered against your brand — the phishing infrastructure aimed at you is discoverable too.
- Write down an owner for every live host. The ones without an owner are your queue.
The point of the pass is not the tooling. It is producing a list where every entry has a name attached to it, because an asset with no owner will not be patched during the next zero-day either.
How this connects to everything else
Discovery is upstream of every other security activity, and its absence quietly breaks them. Patch prioritisation against the KEV catalog is only as good as the inventory you match it against. Zero-day response is a lookup if you know what you run and an investigation if you do not. A penetration test scoped from a stale inventory tests the wrong things thoroughly.
Which is why, of everything a small security team can do in a quarter, an honest external discovery pass usually returns the most: it does not find exotic vulnerabilities, it finds the four hosts that were never supposed to be there.
Frequently Asked Questions
What is external attack surface discovery?
The process of finding everything your organisation exposes to the internet — hosts, services, domains and cloud storage — from the outside, using the same public sources an attacker would, rather than from your internal inventory.
How do attackers find subdomains?
Mostly from certificate transparency logs, which publicly record every trusted TLS certificate ever issued, plus DNS enumeration and historical records. None of it requires touching your systems.
What is a subdomain takeover?
A DNS record still pointing at a cloud resource that has been de-provisioned. Whoever claims that resource next controls content served on a hostname under your domain, inheriting the trust that comes with it.
Why does origin-IP exposure matter if we use a CDN?
Because an attacker who can reach the origin directly bypasses the CDN entirely — the WAF rules, rate limits and bot protection you rely on are all at the edge they just skipped.
How often should discovery run?
Quarterly at minimum, and after any acquisition, launch or infrastructure migration. Continuous is better, because the gap between inventory and reality opens through routine activity rather than rare events.