Most attacks start with someone reading, not breaking in. Here's what's public about your company and what's worth cleaning up.
------------------------------------------------------------------------------------------------------------------
TL;DR: Most cyberattacks on small and mid-size companies begin with research rather than intrusion. Old domains, certificate records, employee profiles, and a company's own website give outsiders a working map long before first contact. Because that groundwork never reaches the target's systems, conventional security tools have nothing to flag. Reviewing what's already public, then pruning what serves an attacker more than a customer, takes away much of that head start.
------------------------------------------------------------------------------------------------------------------
Ask most owners how a cyberattack starts and the answer usually involves someone breaking in. A password gets cracked, a firewall gets outsmarted, or a door that should've been locked wasn't. Those things do happen, and they make for better movie scenes. They're rarely step one, though. Step one is usually reading.
Think about the last time you scrolled through a house listing online. You got the floor plan, a photo of every room (including the one with the questionable wallpaper), which door opens onto the alley, and the hours of the open house. Nobody broke in to learn any of that. The listing was public on purpose because that's how houses get sold. Now, picture someone flipping through those same photos with no interest whatsoever in buying.
Your company has a listing too, and most of it went up for perfectly good reasons. The website is there to win customers, the team page is there to build trust, and job posts are there to fill seats. Attackers read all of it before doing anything else, because reading is free, low-risk, and invisible to the company being read. The 2026 Verizon Data Breach Investigations Report found a human element in 62% of breaches, and the most convincing ways to fool a person start with knowing who they are and who they work with.
Security conversations tend to center on the edge of the network, meaning firewalls, antivirus, and email filters. Those matter, and nobody's suggesting you unplug them. But a growing share of the risk lives outside the network entirely, in information published to market, hire, and look credible. Security teams call that collection of outward-facing details the external attack surface, and keeping track of it has become a discipline of its own.
Anything an outsider can read about your company, you can read first, and you'll do it with far better context about what matters.
Security folks call the homework an attacker does before making a move reconnaissance, and the main framework for mapping real attacks, MITRE ATT&CK (Adversarial Tactics, Techniques and Common Knowledge), gives it a stage of its own, well ahead of any break-in.
It comes in two flavors. The active kind pokes at your systems and leaves fingerprints. The passive kind never touches anything you own; somebody just searches, cross-references, and takes notes on what's already in the open. Nothing reaches your equipment, so nothing gets logged. As far as your systems can tell, it's a slow Tuesday.
The skill behind the passive kind is open source intelligence, or OSINT. Journalists, investigators, and recruiters use it every day, the SANS Institute teaches it as a standard course, and most of the tools cost little or nothing.
That's the sobering reality for a business owner. Researching a company takes patience, not genius, and a motivated stranger with an afternoon and a search engine can learn more about a 40-person company than most of its vendors know. No wonder it's the first move.
The reality is that most companies couldn't tell you how many domains they own. They pile up like extension cords in a garage, from the old campaign site to the retired product name to the one somebody bought on a personal credit card because it beat waiting on purchasing. Every one of them leaves a public record of when it was registered, when it expires, and where it points.
Subdomains are even chattier. A name like portal, VPN, or remote works a lot like the badge on the back of a car. You know it's the turbo model before anyone pops the hood, and an attacker knows you run remote access before touching a single system.
Certificates are where a perfectly good idea comes with an awkward side effect. Publicly trusted certificates (the ones behind the padlock in your browser) get recorded in public transparency logs, which makes it very hard to issue a fake one for your domain. Those same logs are searchable by anyone, though, so a few keystrokes turn up every subdomain that's ever had a certificate, including the test server someone set up years ago and promptly forgot.
A domain nobody's watching can end up working for somebody else, and that problem is big enough to get its own post later in this series.
Firewalls get a lot of attention, and they deserve it. People don't come with one. A team page, a few dozen professional profiles, last spring's press release about the new operations manager, and a couple of open job posts will tell a stranger more about who does what than any org chart ever pinned to a break room wall.
Email addresses barely count as a puzzle. Most companies pick one format and never change it, so one address spotted on a contact page or an old newsletter is enough to guess the rest. Pair that with the names from those profiles and the result is a staff directory nobody had to steal, just assemble.
What matters more is who handles what. Job descriptions mention who approves invoices. Profiles spell out who manages IT, who runs purchasing, and who started last week and wouldn't recognize the controller's voice on the phone. And the phone matters here. Verizon's 2026 breach report found that in phishing simulations, people fell for voice and text lures roughly 40% more often than email ones. Attackers have noticed, too.
A lot of security advice jumps straight to "scrub your website," and frankly, that's lazy. A business that hides every employee looks sketchy to its own customers and still won't stop a caller who's prepared. The smarter move is knowing what's out there and deciding which details help customers find the right person and which mostly help someone pretend to be that person.
How that gets turned against new hires and help desks is a story of its own, and it gets a full post later in this series.
Everybody uses their work email to sign up for things, and nobody reads the fine print. Webinars, supplier portals, the trade-show app that got opened exactly once. Sooner or later, one of those services gets breached, and the list of exposed addresses ends up being passed around online. Most people assume the scary part of that list is the passwords. It usually isn't, since they're often old or scrambled. The useful part is the confirmation. Every address on it is real, the person behind it was active somewhere, and odds are decent a few of them reuse passwords, because people are people. (Credentials showing up for sale is a related headache, covered in Why Dark Web Recon Is Your Network's Missing Bodyguard.)
Then there's the company website, which is built to be read and gets read more carefully than most owners would like. The page code behind a site often announces which content system it runs and which version, a bit like a water heater with its install date stamped on the side. Anyone walking past can tell roughly how long it's got. Login pages reveal which platforms sit behind the site, and the contact form usually names whoever handles billing, because that's helpful to customers. It's also helpful to everybody else.
The friendliest pages tend to be the chattiest. Case studies and vendor logos say who you buy from and who you sell to, and that's exactly the context someone needs to fake an invoice from a supplier you already pay. None of that means pulling down a case study that wins business; that'd be the security equivalent of selling the truck because it might get a flat. It means the website belongs on the list of things someone reviews for exposure, not only the list of things marketing refreshes every spring.
Stack the breach lists, and the website on top of the domains and the people, and an outsider has a pretty detailed picture of the business. Nobody logged in. Nobody broke anything. They just read carefully, which is more than most companies have done with their own information.
Taken one at a time, none of this should keep anyone up at night. The trouble starts when somebody lines the pieces up like a jigsaw puzzle on a card table, and the same three pictures keep coming out of that box.
The first one ends with money leaving the building. A supplier's logo from a case study, the accounts payable clerk's name from a professional profile, and the company email format add up to a polite note asking to update banking details before Friday's payment run. Vendor fraud gets its own post next in this series, but the short version is that the email works because every name in it checks out. The FBI's Internet Crime Complaint Center logged 24,768 business email compromise (BEC) complaints in 2025, with reported losses topping $3 billion. That's not a typo, and it's only what got reported.
The second picture starts with a domain that somebody stopped paying for. Once it lapses, anyone with a credit card can register it and start catching email still flowing to the old addresses. A near-twin with one letter swapped works almost as well, since nobody squints at a sender address on a busy Thursday.
The third starts with a cheerful new-hire announcement. Somebody calls the help desk as the new employee's manager, drops the right names, and asks for a quick password reset. Help desks exist to help, and a confident caller with accurate details sounds a lot like a stressed-out manager having a bad morning.
None of this is hacking in the movie sense; no hoodie, no green text. It's reading plus a little nerve, and it sails past firewalls and antivirus because those tools watch what touches your systems. This never does.
Security vendors love telling small businesses they're targeted because they're small. That's only half right. They get picked because they're easy to research and slow to notice. A 40-person shop usually has one office manager handling payables, onboarding, the toner order, and the IT provider's calls. That's efficient, and it also turns one name into a skeleton key.
Then there's the pace of play. Watching old domains and dead logins isn't anyone's job, so it doesn't happen, and that's not laziness; it's a calendar problem. IT companies are hardly immune, either. The cobbler's kids have famously bad shoes.
Some exposure is simply the cost of doing business. A tool-and-die shop lists certifications and big-name customers to win bids, and a vet practice introduces every doctor so that nervous pet owners feel better walking in. Hiding that would cost real customers to inconvenience hypothetical criminals, which is a lousy trade.
You don't have to outrun the bear, just the slowest hiker. Criminals shop for the company where the research goes quickest, and with a human element in most breaches, that route usually runs through staff, not servers. Being a little harder to read than the shop down the road isn't glamorous, but it's realistic, and realistic tends to win.
External attack surface management is a mouthful, and the industry has made it sound like it requires a six-figure platform and a team in matching polos. Strip the marketing off and it means knowing what's out there about your company and checking on it regularly. IBM frames the defensive version the same way, with organizations running open source research on themselves to find leaks before somebody less friendly does. People, process, technology, in that order, and most companies try to buy the third one first.
The first lap doesn't need a specialist, just an hour, a cup of coffee, and five checks.
Notice the list didn't involve buying anything. Tools are great at watching once someone decides what's worth watching. They're terrible at noticing the renewal notices are going to Dave.
The goal here is less useful detail for an attacker, not a company that vanishes from the internet. Vanishing isn't realistic, and it'd be terrible for business anyway. Customers need to find you. The trick is making sure they find you more easily than they find your accounts payable process.
Start with the stuff nobody would miss. Domains and subdomains that don't do anything anymore should be retired on purpose or locked down and watched, not left to expire on their own schedule. Old landing pages, the test site from the last redesign, and login pages for platforms you stopped using years ago can usually go. Published approval chains ("send invoices to Pat, who forwards them to the owner for sign-off") are handy for exactly one audience, and it isn't customers. Accounts tied to former employees, including vendor portals and shared mailboxes, belong on the same list. Paying to keep any of that around is like renting a storage unit for boxes nobody's opened since the last move.
Then leave the useful stuff alone. Your address, your phone number, what you do, and the people customers need to reach are the whole reason the website exists. Treat the team page the way a good mechanic treats a squeaky belt, by finding the real cause before ripping parts out. Often, the fix is as small as dropping direct lines and internal titles that only matter to the people who already work there.
This is where a managed service provider (MSP) helps, and not because the checks in the last section are hard. They're easy to start and even easier to forget. An MSP can dig further than an owner's afternoon of searching, separate the findings that matter from the noise, and keep watching after the first cleanup. That last part matters more than people expect, because a company's public footprint grows back. New hires, new vendors, and a fresh website all add to it, usually without anyone mentioning it to IT.
Most attacks on smaller companies start well before anyone gets near your network. Someone pieces together who registered what, which subdomains exist, who works where, which addresses turned up in old breaches, and what the website gives away, then lines those details up into a payment scam, a borrowed domain, or a convincing phone call. Nothing sets off an alarm because nothing touches your systems. The fix isn't more gear. It's an honest look at what's public, cutting what mostly helps a stranger, and keeping an eye on it as the company changes.
For most owners, the problem isn't apathy. It's that this lands in nobody's lap. The registrar login lives in an old inbox, the team page hasn't had a second look since launch day, and the person who pays the bills is also the easiest employee to find online. It's hard to fix something nobody's ever put in front of you.
CNWR spends most of its days on the unglamorous side of security, which is exactly where this problem lives. Managed IT and cybersecurity done right includes knowing which domains and systems a company has facing the outside world, closing out accounts when people leave, and making sure the help desk verifies a caller before resetting anything. It also means telling owners plainly which exposures deserve attention and which aren't worth losing sleep over, rather than handing over a tool and a scary report. After three decades of this, the team would much rather tell you something's fine than sell you something you don't need.
If you'd like a clear picture of what a stranger can learn about your company, reach out to CNWR and schedule a call. The listing's already up, so you might as well be the first to read it.
1. What is an external attack surface?
Your external attack surface is everything about your company that someone outside can reach or read. That includes domains and subdomains, internet-facing systems like remote access portals, certificate records, and public information about your people and vendors. Security teams track it because attackers study it first. The bigger and less organized it is, the more options an attacker has, so keeping a current list is the starting point for shrinking it.
2. Is it legal for someone to collect this information about my company?
In most cases, yes. Reading public websites, domain records, certificate logs, and social profiles generally isn't illegal, which is part of why attackers start there. Using that information to commit fraud or break into systems is a different story. It's also why this kind of research rarely triggers an alarm. Your best defense isn't stopping people from reading; it's making sure what they find isn't worth much.
3. How often should a small business check its public footprint?
A full review once or twice a year works for most small businesses, with quick checks whenever something changes. New domains, a website redesign, a round of hiring, a new vendor, or someone leaving the company can all add to what's public. Many companies fold this into their regular IT reviews so it doesn't depend on someone remembering. The habit matters more than the exact schedule.