How to reduce your attack surface as a UK small business

Here's a scenario that plays out often enough to be a pattern, not a one-off: a business completes a security review and discovers it has eleven subdomains, of which four are actively used and seven are remnants of old projects, campaigns, and services. Two of those seven are pointing to cloud services the business cancelled. One is resolving to an IP address that now belongs to someone else. None of this was deliberate — it accumulated over several years of normal business activity. Fixing it takes an afternoon. Finding it in the first place is the hard part.

Reducing your attack surface isn't a complex security programme. It's a deliberate practice of removing or securing everything your business unnecessarily exposes. Here's how to approach it.

Start with discovery before remediation

You can't reduce what you don't know exists. The first step is understanding your actual external attack surface — not what you think it is, but what's actually there. That means discovering every subdomain associated with your domain, every service accepting connections on your IP addresses, every DNS record published under your domain, and any exposed credentials or configuration files in public repositories.

An external vulnerability scan handles this discovery automatically. Running one before trying to reduce anything gives you a complete picture rather than a partial one, and ensures the reduction work addresses what's actually exposed rather than what someone assumed was exposed.

Remove what doesn't need to exist

The most effective attack surface reduction is removal — not hardening, but eliminating assets that no longer need to be there. For most businesses that have been operating for more than a few years, this means:

Old subdomains that are no longer actively used — check what each resolves to, whether it's still needed, and if not, remove the DNS record and properly decommission the underlying service. A dangling DNS record pointing to a cancelled cloud service is a subdomain takeover waiting to happen.

Services running on ports that aren't needed — anything accepting connections that isn't required for the legitimate operation of the business is unnecessary exposure. Database ports, remote management interfaces, and old FTP services should not be reachable from the open internet.

Old integrations and connected services — third-party tools connected to your domain or infrastructure that are no longer actively used should be properly disconnected, with any associated credentials revoked.

Harden what does need to exist

For assets that genuinely need to remain accessible, the goal is ensuring they're configured correctly rather than left at defaults. The key areas are:

Email authentication — DMARC, SPF, and DKIM records configured correctly, with DMARC set to p=quarantine or p=reject rather than p=none.

Security headers — HSTS, Content Security Policy, X-Frame-Options, and the other headers that configure browser behaviour when loading your site. Missing headers are one of the most consistent findings on scans of small business websites.

SSL certificates — valid, not expired, and issued by a CA listed in your CAA record.

Access controls — admin panels and management interfaces should not be reachable from the open internet without authentication, and ideally should be restricted by IP or behind a VPN.

Monitor for new exposure continuously

Attack surface reduction isn't a one-off exercise because your attack surface isn't static. New services get connected, new subdomains get created, certificates expire, DNS records go stale. The work of reducing your attack surface needs to be maintained, which means monitoring continuously rather than reviewing periodically.

Olimpio's scheduled scanning runs automatically at the frequency you configure and alerts when new findings appear — so a new subdomain that introduces exposure doesn't sit unnoticed for months between manual reviews.

Frequently asked questions

How long does it take to reduce the attack surface of a typical small business? Discovery and assessment typically takes under an hour with an automated tool. Remediation time depends on what's found — fixing DNS records and security headers might take a few hours; decommissioning old infrastructure properly might take longer if it involves contacting third-party providers.

Do we need to hire someone to do this, or can we manage it ourselves? For the external attack surface — DNS, subdomains, security headers, certificates — a non-technical business owner can manage this with the right tooling. The findings and remediation guidance should be in plain English, not requiring security expertise to interpret.

What's the single highest-impact attack surface reduction for a small business? Fixing email authentication, specifically ensuring DMARC is set to enforcement rather than monitoring mode, closes off the most common form of domain impersonation. After that, removing old subdomains pointing to cancelled services eliminates a class of risk that requires no technical attack to exploit.

Does reducing our attack surface affect our website's functionality? Removing genuinely unused assets and adding security headers shouldn't affect functionality. Security headers occasionally need careful configuration if the site loads third-party resources, but the headers themselves don't break anything when configured correctly.

How do we prevent attack surface from growing again after we've reduced it? Continuous monitoring catches new exposure as it appears. The other component is process — making sure that when new services are connected or new subdomains are created, there's a corresponding process for decommissioning them properly when they're no longer needed.

Run a free scan to discover your current attack surface and see what can be removed or hardened: olimpio.io/free-scan