What does your company look like on the internet to someone trying to break in?

Here's a scenario that plays out often enough to be a pattern, not a one-off: a business owner assumes their company is too small to be worth targeting. What they don't account for is that most attacks aren't targeted at all. They're automated scans looking for businesses with specific, exploitable gaps — an exposed admin panel, a missing DMARC record, an open database port. The attacker doesn't choose the business. The business's attack surface chooses the attacker.

Before anyone decides whether to target you, they can already see a significant amount about your business from the open internet. Here's what that picture actually looks like.

Your domain and DNS records

Your domain is the starting point for almost any external reconnaissance. From your domain alone, an attacker can discover your mail server configuration, whether your domain has DMARC, SPF, and DKIM records and what those records say, whether a DMARC record set to p=none means spoofed emails from your domain will be delivered unchallenged, which DNS provider you use, and whether you have a CAA record restricting which certificate authorities can issue certificates for your domain.

None of this requires any special access. It's all publicly visible in DNS, designed to be — DNS is a public directory. The question is whether what's in that directory tells an attacker your domain is a soft target or a hardened one.

Your subdomains

Certificate transparency logs are public records of every SSL certificate ever issued for a domain. They're searchable by anyone, and they reveal every subdomain that has ever had a certificate — including subdomains for internal tools, old marketing campaigns, staging environments, and services that no longer exist but whose DNS records were never cleaned up.

A subdomain pointing to a cloud service the business has since cancelled is a subdomain takeover candidate. A staging environment accessible from the internet is a potential entry point with weaker security controls than production. An internal tool exposed externally is access that was never intended to be public.

Your open ports and services

Port scanning reveals which services are accepting connections on your servers. An open port on its own isn't a vulnerability — web servers need port 443 open. But an open database port, an exposed remote desktop service, an FTP server still running from a previous hosting arrangement, or a management interface reachable from the open internet are all things that show up in automated scans and get tried automatically.

The attacker doesn't need to target you specifically. They scan entire IP ranges looking for anything responding on interesting ports, then work down the list of what's found.

Your security headers and web configuration

When someone visits your website, their browser receives a set of response headers from your server. Those headers reveal how your site is configured — or rather, how it isn't. Missing security headers tell an attacker that your site hasn't been specifically hardened, and that certain categories of attack that those headers would prevent are worth trying.

A missing Content Security Policy suggests cross-site scripting attacks haven't been mitigated. A missing X-Frame-Options header suggests clickjacking might work. A server version disclosure header tells them exactly which software you're running and which known vulnerabilities apply to that version.

What Olimpio shows you

Olimpio runs the same reconnaissance an attacker would run — subdomain discovery through certificate transparency logs and passive enumeration, DNS and email authentication checks, port scanning, security header analysis, SSL certificate verification, and checks for exposed files and admin panels — and returns the results ranked by severity in plain English.

The difference is you see it first and get the fix, rather than finding out from a breach.

Frequently asked questions

Can an attacker really find all of this without any special access? Yes. Everything described here is publicly accessible from the open internet. No credentials, no inside access, no specialist tools that aren't freely available. This is standard pre-attack reconnaissance.

How quickly can someone map our attack surface? Automated tools can complete a basic reconnaissance pass on a domain in minutes. A more thorough enumeration might take an hour. This is not a slow, careful process — it's industrialised and runs continuously across the internet.

Does having a firewall protect against this kind of reconnaissance? A firewall controls inbound traffic but doesn't hide what's already publicly visible in DNS, certificate logs, or HTTP responses. Reconnaissance doesn't require getting past a firewall — it uses what's already public.

If we're a small business, are we really being scanned like this? Yes. Automated scanning doesn't discriminate by company size. IP ranges and domain lists get scanned continuously, and anything found gets added to lists that are used for follow-up exploitation attempts. Small businesses are frequently targeted precisely because their defences are assumed to be weaker.

What's the first thing to fix if our attack surface looks exposed? Email authentication is the most common and most exploitable gap — a missing or unenforced DMARC record means your domain can be used to send phishing emails to your clients right now. After that, any open ports beyond what's needed for web and email, and any missing security headers on your main site.

Run a free scan to see exactly what your company looks like from the outside: olimpio.io/free-scan