Attack Surface
A reasoned list of everything that needs protecting, and of how much each thing matters. This is where every Dottor Box scan starts.
Your company's perimeter, in black and white
Most incidents come through something nobody knew they had exposed. The Attack Surface is where you put your perimeter in writing: which networks, which public addresses, which applications, which email domains, which brands to keep an eye on.
It is not a summary of scan results: it is the register of the assets to monitor. What you list, enable and confirm here is exactly what gets checked. Nothing is scanned by chance, and nothing is left out by oversight without it being visible.
You give each asset a criticality level, with the reason for it. So when a finding comes in, you already know whether it concerns a marginal system or the heart of the company.
Companies can focus their resources effectively on protecting their most critical assets.
What you get
A single register
Networks, public addresses, applications, domains and brands to monitor, in one place, with a count for each family.
Criticality asset by asset
Five levels, from low to high, with the reason: so you can prioritise what really matters.
Subdomains discovered every night
The platform looks for new subdomains and suggests them to you: you list them or discard them.
The basis of every scan
All the other checks take their targets from here: inventory and monitoring are never separated.
Five families of assets to list
For each family you see how many assets you have listed and how many are high risk.
Internal networks
The subnets at your premises, with exclusions by IP address, MAC address and port. They are the targets of the internal network scan: PCs, switches, routers, firewalls, multifunction printers, IoT devices.
External networks
The company's public addresses, checked by the external network scan.
Web applications
Websites, portals and online business applications, including those on the most widely used CMSs, analysed by the web application check.
Email domains
The company's email domains, the target of Dark Web Monitoring for compromised credentials.
Keywords
Company name, brands and domains to search for on the sites where stolen data is published.
Subdomains discovered but not yet listed
An inventory written once and never updated becomes wrong within a few months. That is why every night, at 23:00, the platform looks for subdomains of your domains and shows at the bottom of the page those found but not yet listed.
They are suggestions, not automatic additions: you decide whether a subdomain is an asset to monitor or a leftover to remove. Either way, you have seen it.
Not just a list, an assessment
- Every asset has a declared criticality on five levels
- The criticality always has a written reason
- Scan findings are read in the light of how much the asset matters
- From the page you generate the report chapter on the attack surface
A holistic approach to the attack surface
The report chapter on the attack surface starts from one principle: cyber security has to be looked at as a whole. The methodology reaches beyond traditional boundaries and includes all the critical components of the IT infrastructure: internal network, external network, subdomains, web applications, email addresses.
If you have to demonstrate compliance with NIS2 or ISO/IEC 27001, this register is also evidence: the asset inventory and its classification are among the first things an auditor asks to see.
Which standards it supports
Asset inventory and classification are basic requirements of almost every security framework.
Frequently asked questions about the attack surface
What is a company's attack surface?
It is the set of points from which an attacker can try to get in: public addresses, exposed services, websites and web applications, internal networks, mailboxes, and also credentials and brands circulating online. Managing it means knowing at any moment what is part of it and how exposed it is. Find out more in the glossary: attack surface management.
What happens to an asset that is not listed?
It is not checked. Scans take their targets only from this register, so a server or website that does not appear is left out of the vulnerability assessment. That is why the inventory should be reviewed when the infrastructure changes, and the platform flags the subdomains it finds.
Who defines the attack surface at the start of the service?
We define and validate it together with you at the start: it is the work covered by the one-off initial fee, which establishes the exact make-up of your technology infrastructure. From then on you maintain the register, with the platform's suggestions and, if needed, help from our specialists.
How do you choose an asset's criticality level?
You declare it, on five levels, with a written reason. It helps to ask what would happen if that asset stopped working or its data got out: the business system holding customer data does not weigh the same as the page for a past event. Criticality, together with CVSS severity, decides which findings to tackle first.
Does the price depend on the number of assets listed?
The monthly fee is calculated on the technology assets actually monitored, on the average of the previous 30 days, and not on the number of employees. If you add or retire assets, the fee follows without renegotiating the contract. The model is explained in how it works.
What starts from the attack surface
Vulnerability Assessment
Six checks from inside and outside, with CVSS severity, history and alerts on what is new.
Learn more SeeCyber Screening
What anyone looking at your company from the internet can see, with a risk score to start from.
Learn more SeeAsset Management
A single IT inventory of devices and software, with a graph map of the network.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.