External Attack Surface Management: A 30-Minute Security Check with Shodan
Many small and medium-sized businesses have more systems exposed to the internet than they realize. Shodan can help identify these forgotten services before they become a security problem. Here's how to perform a practical external attack surface check in just 30 minutes.
Ask an IT manager at a small company which systems are accessible from the internet, and the answer is often a short list: the website, email servers and perhaps a VPN.
But an external search can reveal much more. An old test server, a remote desktop port opened for a contractor, an unused cloud instance or a forgotten backup interface may still be publicly accessible.
Attackers use specialized search engines to discover these systems, often without directly interacting with the target's network.
The good news is that businesses can use the same publicly available information to identify unexpected exposure.
A basic check takes around 30 minutes. It will not replace a professional security assessment, but it can help SMEs understand what outsiders may be able to see and where further investigation is needed.
What Is External Attack Surface Management?
External Attack Surface Management (EASM) is the process of identifying, monitoring and reducing an organization's internet-facing assets and potential security exposures.
These assets can include websites, servers, cloud services, remote access systems, network devices and publicly accessible application interfaces.
Unlike traditional asset management, which primarily relies on known internal systems, EASM examines infrastructure from an external perspective.
Its purpose is to answer three important questions:
What systems belonging to our organization are visible from the internet?
Which of these systems are unexpected, unnecessary or potentially insecure?
Who is responsible for securing and maintaining them?
For smaller companies, the challenge is often not a lack of security tools but an incomplete understanding of which systems are actually exposed.
A forgotten service cannot be properly maintained if nobody knows it exists.
Why Internet Exposure Creates Security Risks
Before attempting an attack, cybercriminals frequently look for accessible services that could provide an entry point.
Each internet-facing system potentially increases an organization's attack surface.
For example, an exposed service might contain:
An outdated application with known vulnerabilities
A weak or improperly configured authentication system
An administrative interface accessible without appropriate network restrictions
A forgotten server that no longer receives security updates
A database service unnecessarily exposed to external connections
Not every publicly accessible service represents a security vulnerability. Many systems need internet connectivity to operate.
The risk increases when exposure is unnecessary, poorly managed or combined with exploitable weaknesses.
How Forgotten Systems Become a Problem
Consider a company that temporarily enables remote desktop access for an external contractor.
Once the project ends, the contractor no longer needs access. However, the connection remains enabled because nobody takes responsibility for reviewing it.
Months later, the service may still be reachable from the internet.
Similar situations occur with cloud test servers, network cameras, temporary development environments and administration panels.
Attackers can also monitor newly disclosed vulnerabilities and search for systems that appear to run affected software.
The CISA Known Exploited Vulnerabilities Catalog helps security teams identify vulnerabilities with evidence of exploitation in the wild.
However, the catalog is not a complete inventory of every possible security weakness. A company still needs broader asset management and vulnerability assessment processes.
How Shodan Helps Discover Exposed Systems
Shodan is a search engine that indexes information about internet-connected devices and services.
Traditional search engines primarily focus on web pages. Shodan collects information from network services, including details that devices reveal when responding to its scans.
Depending on the service and available data, a Shodan record may include:
Public IP addresses
Open ports
Service banners
Reported software versions
SSL/TLS certificate information
Hostnames
Network and organization information
This makes Shodan useful for investigating a company's publicly visible infrastructure.
For example, an organization might discover a remote desktop service, an old web administration interface or a database port that was never intended to remain publicly accessible.
Security professionals use similar techniques in authorized external security assessments.
However, Shodan is not a real-time scanner of a company's entire network. Its results are based on previously collected information and may be incomplete or outdated.
For that reason, Shodan should be treated as a discovery tool rather than proof that a particular system is vulnerable.
A Practical Example From a Simulated Company Network
To demonstrate how overlooked systems can become visible from the outside, I created a controlled lab environment designed to imitate the infrastructure of a small business.
The simulated company had approximately ten employees and several typical services:
A public website
An email server
VPN access
Several cloud servers
A small collection of internal applications
I then conducted an external exposure review, comparing the systems visible through search tools with the infrastructure included in the simulated company's inventory.
The expected services were present.
However, the review also revealed an additional web interface associated with a backup system.
The interface was internet-accessible and displayed a login page together with a software version banner indicating an older release.
Within the lab scenario, the backup interface represented a temporary migration server that had never been properly decommissioned.
Because it was missing from the simulated inventory, nobody would have been assigned responsibility for maintaining it.
It took approximately five minutes to identify the unexpected interface and another ten minutes to complete the simulated remediation.
This example comes from a controlled lab exercise, not a client engagement or an actual company security incident.
The lesson is straightforward: an organization's internal asset inventory does not always reflect everything outsiders can discover.
That difference is one of the problems External Attack Surface Management aims to address.
How to Perform a 30-Minute External Attack Surface Check
A basic external exposure review can be performed using existing company records and publicly available information.
The following process is designed for small and medium-sized businesses that want to understand their external visibility.
The 30-minute schedule covers initial discovery and documentation. Investigating findings and implementing security changes may require additional time.
Step | Task | Time |
|---|---|---|
1 | Identify domains, IP addresses and external assets | 5 minutes |
2 | Search for exposed services using Shodan | 10 minutes |
3 | Compare findings with the company inventory | 5 minutes |
4 | Prioritize potentially risky exposure | 5 minutes |
5 | Check relevant vulnerability information | 3 minutes |
6 | Record findings and assign next actions | 2 minutes |
7 | Schedule the next review | Ongoing |
Step 1: Identify Your Internet-Facing Assets (5 Minutes)
Start by preparing a list of the external assets your company owns or manages.
Include primary domains, relevant subdomains, public IP addresses, cloud servers, office internet connections and infrastructure maintained by external providers.
Also consider temporary environments used by developers, agencies or contractors.
If you do not know which public IP addresses belong to your organization, contact your hosting company, cloud administrator or IT service provider.
The more accurate your initial inventory, the more useful the external comparison will be.
Step 2: Find Exposed Services With Shodan (10 Minutes)
Use Shodan to look for services associated with the assets identified in Step 1.
Several search filters can help narrow the results.
Search by hostname
hostname:yourcompany.com
This searches records associated with the specified hostname or domain.
The results depend on what Shodan has discovered and how hostnames are associated with the observed systems.
Search by network range
net:203.0.113.0/24
This searches for observed services within the specified IP address range.
Replace the example with a public address range owned or authorized for assessment by your organization.
Search by organization
org:"Your Company Name"
This searches using organization information associated with network ownership.
Keep in mind that cloud-hosted systems may be associated with the cloud provider rather than the company using them.
Search by SSL certificate information
Certificate information can provide additional clues about services associated with a company domain.
However, certificate-based searches are not exhaustive. Shared infrastructure, different certificate fields and naming conventions can affect the results.
Filter by port
Specific port filters help identify particular categories of exposed services.
Shodan filter | Common service | Security consideration |
|---|---|---|
port:3389 | Remote Desktop Protocol | Remote administration should have strong authentication and appropriate access restrictions. |
port:22 | SSH | Administrative connections should be secured and limited to authorized users. |
port:3306 | MySQL | Database services generally should not be publicly accessible without a specific requirement and suitable protections. |
Filters can also be combined.
For example:
net:203.0.113.0/24 port:3389
This searches for services associated with RDP's standard port within the specified network range.
The full search-filter documentation is available in the Shodan Help Center.
These searches are starting points, not a guarantee that every relevant asset will be found.
Step 3: Compare the Results With Your Inventory (5 Minutes)
Review the Shodan results and compare them against the systems your organization expects to expose.
For every unexpected result, consider the following questions:
Do we recognize this server, device or application?
Does the system belong to our company?
Who manages it?
Is it still required for business operations?
Why does it need public internet access?
Are its security controls appropriate?
An unfamiliar result should be investigated before drawing conclusions.
It may represent forgotten infrastructure, but it could also be an outdated observation or a system incorrectly associated with the company.
Step 4: Prioritize Potential Security Risks (5 Minutes)
Not all exposed systems carry the same risk.
Begin with services that provide administrative access, handle sensitive data or may be affected by known vulnerabilities.
Remote desktop services, databases, file shares and administration interfaces exposed to the entire internet deserve particular attention.
If public access is unnecessary, consider removing it or restricting access through appropriately secured remote access solutions.
A VPN or zero-trust access approach may be suitable for administration, depending on the environment.
Multi-factor authentication should also be enabled wherever supported.
Before changing a system, verify ownership and coordinate with its administrator to avoid disrupting legitimate operations.
Step 5: Check Known Vulnerabilities (3 Minutes)
Where the available data identifies a software product and version, compare it with relevant vendor advisories and vulnerability information.
The CISA Known Exploited Vulnerabilities Catalog is a useful starting point for identifying vulnerabilities known to have been exploited.
However, Shodan's reported version information may be incomplete or inaccurate.
A version banner alone does not establish that a service is vulnerable or that an exploit will work.
Further authorized verification is required.
Step 6: Document Findings and Assign Actions (2 Minutes)
Record unexpected systems in a simple inventory.
At minimum, document:
IP address or hostname
Observed service
Responsible person or provider
Business purpose
Potential security concern
Required follow-up action
For a small number of findings, this initial documentation can be completed quickly.
More complex systems may need a separate technical assessment and remediation plan.
The objective is to make sure every finding has a responsible person and an appropriate next step.
Step 7: Repeat the Check Regularly
External exposure changes over time.
Cloud resources are created and removed. Contractors receive access. Applications are updated, replaced or forgotten.
A monthly review can help detect changes before they become long-term security problems.
Additional checks are worthwhile after infrastructure migrations, major projects or changes involving external IT providers.
What Shodan Cannot Tell You About Your Security
Shodan provides useful external visibility, but its limitations are important.
Shodan Results Can Be Outdated
Shodan records what a service returned during a previous scan.
A system may have been patched, disconnected or reconfigured since that observation.
Likewise, a newly exposed service may not yet appear in search results.
An Exposed Service Is Not Necessarily Vulnerable
A publicly accessible service can be properly secured.
The presence of an open port, login page or software banner does not automatically demonstrate a security weakness.
For example, an SSH service may be intentionally accessible while using strong authentication, limited access permissions and appropriate monitoring.
Exposure should be evaluated in context rather than treated as proof of compromise.
Missing Search Results Do Not Mean a System Is Safe
A service absent from Shodan may simply not have been observed or associated with the search filters used.
Shodan is therefore not a substitute for complete asset management, internal vulnerability scanning or professional security assessments.
Security testing should only be performed on systems you own or are explicitly authorized to assess. Publicly indexed information does not grant permission to access accounts or conduct intrusive testing.
Seven Security Practices That Reduce External Exposure
A one-time assessment can identify unexpected systems. Long-term security depends on consistent processes.
1. Keep Unnecessary Services Private
Every publicly reachable service should have a documented business purpose.
If external access is unnecessary, remove it or restrict it appropriately.
2. Secure Remote Administration
Avoid exposing management interfaces unnecessarily.
Use appropriate access restrictions, secure remote access solutions and strong authentication.
3. Assign Responsibility for Every System
Each internet-facing service should have an identified owner responsible for updates, security and ongoing maintenance.
4. Enforce Multi-Factor Authentication
Enable multi-factor authentication wherever supported, particularly for administrative accounts and remote access services.
5. Review External IT Providers
Hosting providers, agencies and contractors may manage infrastructure on your company's behalf.
Regularly review which systems they operate, who has access and whether those systems remain necessary.
6. Enable Logging and Security Alerts
Monitoring repeated failed login attempts and suspicious activity can help identify potential attacks.
Even smaller organizations can benefit from appropriately configured alerts.
7. Remove Forgotten Infrastructure
Temporary systems should have clear owners and planned decommissioning dates.
When a project ends, review its infrastructure instead of assuming that unused services will disappear automatically.
Who Should Be Responsible for External Attack Surface Management?
In many SMEs, responsibility for externally accessible infrastructure is divided among internal IT staff, external service providers and individual departments.
Without clear ownership, systems can remain active even when nobody is maintaining them.
A practical solution is to designate one person responsible for coordinating the external inventory and recurring exposure reviews.
This does not necessarily require a dedicated cybersecurity employee.
An existing IT manager or external service provider may be able to coordinate the process.
Management can monitor two useful indicators:
1. Number of known internet-facing services
This shows how many publicly accessible systems the company has identified and needs to manage.
2. Percentage of internet-facing services with a documented owner and business purpose
This helps identify services that lack accountability or a clear operational justification.
Neither metric directly measures the company's overall security.
However, together they provide a useful picture of how effectively external infrastructure is being managed.
External Attack Surface Management vs. Vulnerability Management
Although the two disciplines are closely related, they answer different questions.
External Attack Surface Management | Vulnerability Management |
|---|---|
Identifies externally visible assets | Identifies and evaluates security weaknesses |
Focuses on what an outsider can discover | Focuses on vulnerabilities affecting systems |
Helps reveal unknown or forgotten infrastructure | Helps prioritize remediation of known weaknesses |
Supports continuous external visibility | Supports assessment, patching and risk reduction |
In practice, the two approaches complement each other.
An organization first needs to understand which systems exist and are accessible. It can then assess their security posture and address relevant vulnerabilities.
Shodan can support the discovery stage, but it does not replace the broader technical work required for vulnerability management.
Final Thoughts: Start With Visibility
You cannot properly secure infrastructure you do not know exists.
For small and medium-sized businesses, establishing an accurate picture of publicly accessible systems is an important first step towards reducing unnecessary security exposure.
A 30-minute review using Shodan and existing asset records can identify unexpected services and highlight areas requiring further investigation.
It is not a penetration test, a complete vulnerability assessment or a guarantee of security.
Its real value is in establishing a repeatable process: identify external assets, verify their purpose, assign responsibility and address unnecessary exposure.
For companies with limited security resources, this straightforward approach can provide a useful foundation for more effective cybersecurity management.
References and Further Reading
CISA: Cyber Hygiene Services, available to eligible U.S. government and critical infrastructure organizations.
About the Author
Canio Campaniello is an independent cybersecurity researcher, technical writer and founder of Hackita.it, an Italian publication focused on offensive security and ethical hacking.
His practical experience includes independent security research, hands-on penetration testing labs and bug bounty activities. He also shares technical knowledge through cybersecurity publications and is preparing for the OffSec OSCE3 certification path.
