External attack surface monitoring
- Home
- External Attack Surface Monitoring
Know what the internet can reach, notice when that changes, and fix the things that matter first.
Watching the outside of your network on a schedule
External attack surface monitoring (EASM) is recurring work to find and track systems the public internet can reach: domains, subdomains, public IPs, open ports, exposed services, and TLS issues.
Most exposure problems are boring leftovers. A temporary admin panel stayed up after a deploy. A firewall rule opened for troubleshooting never got closed. An update started a listener nobody expected. EASM is how you catch those changes while they are still small, instead of only after a quarterly scan or a bad surprise.
In practice, it answers a short list:
- What is exposed right now?
- What changed since last time?
- What is high risk vs expected noise?
- What should we fix first?
- Did the fix actually work when we retested?
PortWarden is built for small businesses, MSPs, and lean IT teams that need those answers without a pile of raw scanner output. You get scheduled checks, change-aware findings, and guidance you can act on.
Start free monitoringNo credit card required. Monitor up to 3 endpoints free.
What PortWarden tracks
- Domains, public IPs, and exposed services
- Open ports on each monitored endpoint
- TLS and certificate problems you can see from outside
- Unexpected change over time
- Findings, history, and fix-first guidance
Exposure drifts while everyone is busy shipping
Small teams move fast and wear multiple hats. That is fine for product work. It is rough for the public edge unless something is watching it.
Deploys leave leftovers
Short release cycles are normal. Temporary services, admin panels, and test listeners are also normal, and they sometimes stay public after the release window closes.
Config drift piles up
Firewall edits, cloud security groups, upgrades, and vendor defaults can widen exposure quietly. Without recurring checks, you only notice when something breaks.
One person cannot read every dump
If the same person owns infra, support, and security, a 40-page report is useless. You need what changed and what to do next.
Odd services show up
A common port can return an uncommon banner. HTTPS can present a certificate that does not belong. Fingerprint mismatches are often the first useful clue.
Customers still ask
Even without a formal certification project, buyers ask how you watch the edge. Being able to show scheduled checks and retests is better than hand-waving.
Cleanup beats incident mode
A small exposure found during drift is boring work. The same issue found during an incident is downtime, scramble, and lost focus. Catch it early.
Concrete external risks we look for
Scheduled checks plus history mean you see not only what exists, but what changed. These are the kinds of issues teams triage from PortWarden findings.
Open ports and unexpected listeners
A new open port is not always bad. It always needs context. We check publicly reachable ports on monitored endpoints and compare runs over time.
- Port that used to be closed after a deploy
- Management protocol visible from the internet
- Banner change that suggests a different service
- Known port behaving unlike the service you expect
Exposed databases and data services
Databases on the public internet are a high-impact class of mistake. Auth may exist and still leave you open to brute force, metadata leaks, or a bad config.
- Database reachable directly from the public internet
- Data-service port opened during maintenance and left that way
- Legacy service still public after a migration
- New data endpoint that is not in your approved inventory
RDP and remote access
Remote access is often needed. Direct public exposure still attracts constant attack pressure. Monitoring shows where it appears, changes, or outlives the support window that justified it.
- RDP open to the world on an important host
- Temporary remote access left after vendor support
- SSH or remote admin outside your normal policy
- Odd service behavior on common admin ports
TLS and certificates
Broken or weak TLS shows up from outside and erodes trust fast. We surface certificate and protocol issues so you can fix them before customers or auditors do.
- Expired or soon-to-expire certificates
- Name mismatch or unexpected issuer chain
- Weak protocol or cipher setup
- TLS changes after an app or proxy update
Configuration drift on internet-facing assets
A lot of external risk starts as drift: emergency changes, manual firewall edits, upgrade defaults, cloud policy tweaks nobody reviewed. PortWarden keeps scan history so those shifts stand out.
Examples:
- Security group change that widens who can connect
- Host or container update that opens a new port by default
- Staging service that became reachable like production
- Unexpected fingerprint on a known production endpoint
- Behavior change that warrants a deeper on-demand scan
Monitor first. Go deeper only when a finding earns it.
Start with recurring monitoring on the endpoints that matter. Triage what changed. Fix in priority order. Retest. Run an on-demand advanced scan when a finding needs stronger evidence. Use higher-tier guidance when your team wants extra help reading the report.
That sequence keeps cost and noise down. You are not buying maximum depth on every asset every day. You still have a path to deeper validation when something looks wrong.
See monitoring details View servicesWhat teams get out of it
- Less guesswork about what is public
- Faster notice when something changes
- A short fix list instead of a dump
- Retests that show whether the fix stuck
- Room to escalate without changing tools
What good external monitoring looks like week to week
Scanning alone is not the job. Discovery, change detection, prioritization, fix ownership, and retest have to run as a loop.
1) Keep an inventory of what faces the internet
Start with domains, subdomains, and public IPs you own or manage for clients. Include production, externally reachable staging, and edge gear that tends to get exposed during rollouts.
2) Check on a schedule
A one-off scan is a snapshot. Recurring checks show new exposure when it appears, not weeks later. Most of the value is in the comparison.
3) Prioritize by impact
A low-risk service on a noncritical host is not the same as public remote admin on a customer-facing system. Rank by how easy it is to abuse, how important the asset is, and how wide the blast radius is.
4) Give each fix an owner
Findings do not close themselves. Assign someone, set a realistic window, and keep the next step concrete. Vague security work stalls. Clear evidence with a clear action gets done.
5) Retest from the outside
Closing a ticket is not the same as closing exposure. Retest to confirm the internet sees what you intended. That is how you avoid false confidence.
6) Escalate when the finding earns depth
If monitoring hints at broader risk, run a targeted on-demand scan for stronger evidence before you call it done. Monitoring feeds deeper work. It does not replace it.
