Home / Security Program / Attack Surface

Attack
Surface Assessment

Discover and analyse everything an attacker can see — exposed services, shadow IT, cloud assets, and forgotten infrastructure — to give you a complete map of your exposure before any testing begins.

Pricing Contact us Book a call
Overview

See yourself as the attacker does.

You cannot defend what you do not know you have. Attackers start by mapping your exposure — forgotten servers, shadow IT, exposed services, stray cloud assets — and so should you.

We discover and analyse your external (and optionally internal) attack surface, surfacing the assets and exposures you may not know exist, and prioritise them by risk. It is the perfect precursor to penetration testing and the foundation of ongoing attack-surface management.

Coverage

What we discover.

A complete, prioritised map of your exposure.

Aligned to: OSINT Attack surface management NIST SP 800-115
FAQ

Attack surface assessment FAQ

The questions we're asked most about scope, cost, and timing.

How much does an attack surface assessment cost?
Typically €2,000–5,000 depending on the size of your footprint and whether you want ongoing monitoring. Use our estimator for a tailored figure.
What is an attack surface assessment?
A discovery and analysis of everything exposed to attackers — internet-facing services, shadow IT, cloud assets, and forgotten infrastructure — prioritised by risk.
How is it different from a penetration test?
It maps what is exposed (breadth) without exploiting it; a penetration test then goes deep on the assets that matter. The assessment is the ideal precursor to testing.
Will you find shadow IT?
Yes — discovering unknown and forgotten assets is one of the most valuable outcomes, since they are often the least protected.
Do you cover cloud assets?
Yes — exposed cloud storage, services, and misconfigurations are included in the discovery.
Can this be ongoing?
Yes — attack surface management as a continuous service tracks new exposures as your estate changes.
How long does it take?
A one-off assessment typically takes 1–2 weeks.
What do we receive?
A prioritised inventory of your exposed assets and risks, with recommendations and an optional plan for ongoing monitoring.
Related services

Explore more.

Parent serviceSecurity Program→ RelatedVulnerability Assessment→ RelatedMaturity Assessment→ RelatedNetwork Penetration Testing→

Ready to map your exposure?

A 30-minute scoping call costs nothing. An unknown asset costs considerably more.

Book a meeting Send an email