External Risk Monitor: What It Watches

What It Is

The product combines passive research with bounded active reconnaissance across the approved asset boundary. Passive work may use public DNS, certificate, registration, and service information; bounded active checks are rate-limited and restricted to the agreed domains and IP ranges. The review can cover domains, subdomains, IP ranges, open ports, publicly reachable services, HTTP and HTTPS surfaces, certificates, DNS posture, exposed panels, forgotten assets, public-storage indicators, and visible configuration issues. It records what was observed, when it was observed, and why it may matter. It uses passive research and bounded active checks; exploitation and deeper testing belong to a separately authorised penetration test. Findings are grouped with severity context and remediation priorities so that a team can decide what to verify, close, monitor, or hand to a different owner.

Who It Is For

External Risk Monitor suits teams that:

• Need a clearer inventory of public-facing assets after growth, vendor changes, cloud changes, or a long operating period
• Want to identify forgotten domains, services, certificates, panels, or public indicators before they become harder to own
• Need evidence and change notes that product, infrastructure, security, and leadership teams can review together
• Want recurring external visibility that complements penetration testing and internal security ownership

What It Helps Clarify

The monitor helps clarify:

• Which agreed assets are publicly observable and what services or configuration signals appear exposed
• Where domain, DNS, certificate, storage, panel, or service changes need an owner or a verification step
• What observations have sufficient context to prioritise remediation and what needs further investigation
• Which questions fall outside external visibility and require a separate application, cloud, penetration-test, or operational scope

What's Included

• Written scope confirmation covering approved domains, subdomains, IP ranges, cadence, rate limits, and exclusions
• Passive and bounded active reconnaissance within the agreed public asset boundary
• Asset inventory with domains, services, certificates, ports, HTTP/HTTPS surfaces, and visible indicators where available
• Change notes and evidence capture for relevant public-facing observations
• Severity context and prioritised remediation guidance based on the observed state
• Optional analyst walkthrough of findings, ownership questions, and next steps

What's Not Included

• A full penetration test, exploitation, credential use, unrestricted scanning, or access beyond the approved boundary
• Real-time detection, continuous managed operations, 24/7 SOC coverage, or emergency incident response
• A guarantee to discover every asset, eliminate every exposure, prevent future changes, or prove that systems are secure
• Internal configuration review, application code review, cloud migration, or remediation work unless separately scoped
• Legal, compliance, certification, or regulatory assurance

When to Choose It

Choose External Risk Monitor when the team needs a repeatable external view of approved internet-facing assets and wants evidence before deciding what to address. It is useful after a domain or infrastructure change, before a launch, when ownership is uncertain, or as part of a wider security review cadence. It is less suitable when the core question is whether a specific application can resist exploitation; a dedicated application assessment or penetration-testing scope may then be more appropriate. The product works best when the organisation can confirm the asset boundary, name owners for findings, and agree how observations will be reviewed.

Our Approach

We begin by confirming what may be observed and how. The agreed scope sets domains, IP ranges, rate limits, cadence, exclusions, and evidence expectations. We collect public and bounded active signals, then distinguish an observed indicator from a verified internal cause. Findings are documented with enough context for an owner to understand the asset, evidence, possible concern, and practical next step. Each result is reported with its evidence and confidence, so its meaning for risk and exploitability is clear. At handoff, the team receives an inventory and decision record that can support remediation, further verification, or a separately scoped review. This keeps the product useful, focused, and clearly bounded.

Frequently Asked Questions

Related Articles