External attack surface monitoring for small businesses

Published October 23, 2026

External attack surface monitoring means regularly checking everything your business exposes to the internet, from the outside, the way an attacker would see it. It answers a simple question: what can a stranger find out about us, and what could they try?

What counts as your external attack surface

Anything reachable from the internet that belongs to your business, including things you may have forgotten:

• your domain names and every subdomain, such as mail., shop. or test.;
• the DNS records that point those names at servers and services;
• email authentication records (SPF, DKIM and DMARC) that decide who can send mail as you;
• websites, login pages and customer portals;
• open network ports and the services listening on them, such as remote desktop or a database;
• TLS certificates and the encryption settings behind your websites;
• pages hosted by vendors that still point at your DNS, which can be taken over if the vendor account is gone.

Why a small business has more of it than it thinks

Nobody sets out to build a large attack surface. It grows one decision at a time: an agency builds the marketing site, a vendor hosts a booking page on a subdomain, someone spins up a test system and never removes it, a domain is registered for a campaign and left running. Different people did each of these at different times, and nobody holds the whole list.

Attackers do not need to know your business. Automated tools scan the internet continuously for known weaknesses and exposed services, and they find whatever is there, whatever the size of the company behind it.

What monitoring checks

• Discovery. Finding the domains, subdomains and services that belong to you, so the list stays complete as it changes.
• Email and DNS. Whether anyone can send mail pretending to be you, and whether any DNS record points at a service you no longer control.
• Certificates and encryption. Expired or weak certificates and outdated protocol settings.
• Exposed services. Ports that should not be open to the whole internet.
• Web exposure. Missing security headers and files that should never be readable, such as configuration backups.
• Known vulnerabilities. Software versions that public services announce, compared with public vulnerability databases.

The point is not a single report. It is a record over time: what is new, what was fixed and how long fixing took.

How it differs from a penetration test or a vulnerability scan

A penetration test is a person testing your systems for a few days. It goes deep, and it describes one moment. A vulnerability scan is a tool run when someone remembers to run it, often against a list of systems that someone has to keep current. Monitoring runs on a schedule, finds the list itself and shows what changed since last time.

They complement each other. A penetration test is the right way to probe how an attacker could move once inside. Monitoring is the right way to notice, within days, that something new appeared on the outside.

What to do with the results

1. Start with the highest severity findings. A database open to the internet matters more than a missing header.
2. Fix the quick wins first. Email authentication records, a stale DNS entry or an expiring certificate usually take minutes.
3. Recheck after each fix, so a finding is closed because it is gone and not because someone believed it was fixed.
4. Keep the history. The trend, and how fast problems get fixed, is what you will want to show an insurer, an auditor or a customer who asks.

Where to start

You can learn a lot from your domain name alone. Public DNS records show whether your email is protected against spoofing and whether any record is at risk of takeover, without touching your systems. Active checks, such as port and web checks, should only ever run against systems you have authorized in writing, and a good provider will refuse to run them otherwise.