Your business has a digital footprint. Do you know what is in it?

Here's a scenario that plays out often enough to be a pattern, not a one-off: a business owner is asked by a prospective enterprise client to complete a security questionnaire. One section asks them to list all internet-facing systems and services associated with their domain. They spend an afternoon trying to compile the list and realise they don't actually have a complete one. There's the main website, obviously. The customer portal. But what about the subdomain they set up for a conference two years ago? The staging environment the developer created? The old microsites that redirected to the new site but might still be resolving to something?

Your business has a digital footprint — everything it has ever exposed or published on the internet under its domain and associated infrastructure. Most businesses have a larger, less well-defined footprint than they think.

What makes up a business digital footprint

A business digital footprint includes every domain and subdomain associated with the business, every IP address those domains resolve to, every service accepting connections on those addresses, every SSL certificate ever issued for those domains, every email sent from or to those domains that appears in breach databases, every API key or credential ever accidentally exposed in a public code repository, and every third-party service connected to the business's infrastructure.

The visible part of that footprint — the main website, the published email address — is a small fraction of what's actually there. The rest accumulates over time through normal business activity: new services added, old ones never properly removed, developers creating subdomains for projects, marketing teams connecting tools.

Why footprint grows faster than it shrinks

Digital footprint grows easily and shrinks slowly. Adding a new subdomain, connecting a new service, or creating a staging environment takes minutes. Properly decommissioning old infrastructure — removing DNS records, cancelling the service, revoking any connected credentials — is a deliberate process that often gets deferred and then forgotten.

The result is that most businesses running for more than three or four years have a footprint that includes historical assets that are no longer actively used but still technically present. Each of those assets is potentially visible to anyone looking, and each is a potential entry point for an attacker who finds something the business doesn't know is still there.

The security implications of an unmanaged footprint

An unmanaged digital footprint creates security risk in a specific way: it creates exposure that nobody is responsible for because nobody knows it's there. A subdomain pointing to a cancelled service is a subdomain takeover candidate. An old staging environment with weaker security than production is an easier target than the main site. An API key in a public repository from three years ago may still be valid if nobody rotated it when they discovered it was exposed.

These aren't sophisticated attacks. They're the result of an attacker finding something the business left accessible and nobody thought to lock up.

How to understand your own footprint

The starting point is discovery — finding what actually exists under your domain rather than relying on an internal inventory that may be incomplete. Certificate transparency logs record every SSL certificate ever issued for a domain and are publicly searchable, revealing subdomains that may have been forgotten. DNS analysis surfaces what's currently resolving. Port scanning shows what services are accepting connections.

Olimpio runs this discovery automatically as part of a scan — enumerating subdomains through certificate transparency logs and passive discovery, checking each discovered asset, and surfacing findings ranked by severity. The result is a picture of your actual external footprint rather than what you think your footprint is.

Frequently asked questions

How do I find out what subdomains exist under my domain? Certificate transparency logs are publicly searchable and reveal every subdomain that has ever had an SSL certificate. Tools like crt.sh let you search manually; an automated scan handles this as part of the discovery process.

Is it a problem to have old subdomains that aren't actively used? It depends on what they're pointing to. A subdomain that resolves to nothing is low risk. A subdomain pointing to a service you've cancelled is a subdomain takeover candidate. A subdomain pointing to an old server that's no longer maintained is a potential entry point with no one looking after it.

How often should we audit our digital footprint? Continuous monitoring is more effective than periodic auditing because footprint changes happen continuously. A weekly automated scan catches new assets as they appear rather than discovering them months later in a quarterly review.

Does our footprint include things outside our domain, like social media profiles? The security-relevant footprint — the part that can be exploited technically — centres on your domain, subdomains, IP infrastructure, and connected services. Social media profiles are part of your broader digital presence but aren't typically the technical attack surface.

What should we do if we discover assets we didn't know existed? Assess each one: is it still needed? If yes, is it secured to the same standard as your primary infrastructure? If no, decommission it properly — remove DNS records, cancel the underlying service, revoke any connected credentials.

Run a free scan to discover your full external digital footprint and see what's exposed: olimpio.io/free-scan