Attack surface monitoring for small companies: what to watch

Before an attacker tries anything against a company, they look. They do not need to touch your servers to learn a lot: your DNS, certificate logs, public indexes of internet-facing services, web archives and code hosting sites hold most of what they need. External attack surface management is doing that same reconnaissance on yourself, regularly, so you see it first.

Large companies buy it as a product with a team behind it. A small company can get most of the value by knowing what to watch and how often.

The seven areas worth watching

1. Domains and subdomains. Every name under your domain is a door. The complete list is public: every HTTPS certificate is recorded in Certificate Transparency logs, so old-crm.yourdomain.com stays findable years after you stopped using it. Watch for new names you did not create and old names still pointing somewhere. See Certificate Transparency monitoring and Subdomain takeover.

2. E-mail. Can anyone send mail in your name? SPF, DKIM and an enforced DMARC policy answer that. Is mail to you encrypted? MTA-STS. These are the controls that stop invoice fraud. See SPF, DKIM and DMARC.

3. Certificates and domain registration. An expired certificate takes your site down; an expired domain can be bought by someone else, with all its mail. Both are dates, and dates can be watched.

4. Web configuration. HTTPS everywhere, modern TLS, the security headers, no forgotten admin pages, no third-party scripts loaded without integrity checks, no trackers set before consent.

5. Exposed services. Ports other than the web answering the internet: remote desktop, databases, admin panels, and the vulnerabilities known for the versions they run. See Open ports.

6. Leaks. Old backups kept by web archives, passwords and keys in public code that names your domain, your staff’s addresses in known breaches. See API keys leaked on GitHub.

7. Look-alikes and impersonation. Domains one typo away from yours, registered with mail servers or a sign-in page, and copies of your site. See Look-alike domains.

How often

Attackers look continuously, but a small company does not need to. A reasonable rhythm:

• weekly for the full picture, compared with the week before: what is new, what was fixed, what got worse;
• daily or hourly for the things that change fast and hurt fast: new certificates for your domain, a site going down, a new look-alike with a sign-in page;
• immediately after a change you made: new mail provider, new website, a moved server.

The comparison is the point. A list of 40 findings is overwhelming once; a weekly note saying “one new subdomain, two findings fixed” is something a busy person reads.

Passive first

Everything above can be learned without sending a single packet that a firewall would call an attack: reading DNS, logs, indexes and archives that already exist. That is why it can run every week without anyone’s permission beyond your own, and without risk to your systems. Active testing (scanning your ports, probing your applications) goes further and needs written consent and care; it is a complement, not a starting point.

Turning findings into fixes

A finding is only useful if someone can act on it. For each one, you want to know how serious it is, what to change exactly (the DNS record, the header, the setting), and whether the change worked. Group fixes by who does them: your mail provider settings, your DNS, your web host, your developer. Then check again.

How Perimetry does it

Perimetry Cloud runs this whole external audit on your domains every week (every day on the agency plans), passively, from the outside. It compares each audit with the previous one, explains each finding in plain language with the exact record or setting to change, lets you check a fix in one click, and links findings to NIS2, ISO 27001 and Cyber Essentials. Certificates, uptime, DMARC reports and look-alikes are watched in between. One domain is free.