Confidential Technology Company

The ask.

The client had grown quickly through acquisitions and internal product launches and, candidly, didn’t have a full inventory of what they exposed to the internet. They wanted an outside-in view — what would a real attacker see before ever touching a login page?

Approach.

Passive and active reconnaissance across the client’s domain and subdomain footprint (certificate transparency logs, DNS enumeration, ASN mapping, historical DNS records), followed by service fingerprinting on every live host and a manual review of cloud storage exposure and remote-access portals (VPN gateways, admin panels, forgotten staging environments).

What we found.

Why it mattered.

None of these were individually catastrophic — but taken together they represented exactly the kind of forgotten, unmanaged infrastructure that attackers specifically hunt for because it’s overlooked by internal teams who only monitor production. The dangling subdomain finding in particular is a classic pivot point for phishing infrastructure.

Outcome.

We delivered a prioritized asset inventory alongside the findings — many clients get more long-term value from knowing what they own than from the vulnerabilities themselves. The client used this to formalize a quarterly external attack surface review process.