Services
What we map for you
We look at your organisation the way an outsider does: only with what can be found publicly on the internet. Then we turn what we see into priorities and concrete actions.
Asset discovery
We find all digital assets linked to your organisation, including those not registered centrally. Think of old campaign sites, test environments and supplier systems on your domain.
- Domains and subdomains
- IP addresses and hostnames
- Cloud and hosting indicators
DNS and domain analysis
We review how your domains are set up and whether records point to things that no longer exist. Such "dangling" records can be taken over.
- DNS records and name servers
- Mail records
- Orphaned references
Certificates and TLS
Public certificate logs often reveal domains you had forgotten. We also check whether your encryption is up to date.
- Certificate Transparency
- Expired or unusual certificates
- Outdated TLS versions
Reachable services
We check which services can be reached from the internet and whether that is intended. An open management port or database is often where an incident begins.
- Open ports and services
- Login and admin pages
- Identifiable software versions
Email security
We check whether your domain is protected against spoofing, so criminals can't send email that appears to come from you.
- SPF
- DKIM
- DMARC policy
Configuration and leaks
Small settings with big consequences: missing security headers, public directories or files that shouldn't be online.
- Security headers
- Public directories and files
- Error messages that reveal too much
Prioritising
Not every finding is equally urgent
A long list of scan results helps nobody. We rate every finding on severity, impact and context, and tell you what to tackle this week, this month and this quarter.
| Severity | Meaning | Advice |
|---|---|---|
| critical | Direct abuse possible | This week |
| high | High chance of abuse | Within a month |
| medium | Weakens your security | This quarter |
| low | Good practice | When convenient |
Scope
An external assessment, not a penetration test
SurfaceGuard focuses on mapping and assessing what is publicly visible. We don't try to break in: exploitation, brute force, social engineering and destructive testing are outside this service.
Curious what's online about you?
See the packages or request a no-obligation intake right away.