Review external exposure

External Attack Surface Review

Understand what your public-facing system exposes—and what to fix first.

SaaS and technology teams preparing for a launch, infrastructure change or customer security review.

One authorised public-facing system. Low-impact, unauthenticated checks. This is not a penetration test.

What you receive

• A map of exposed hosts, services and endpoints within the agreed system boundary.
• Manually checked findings with evidence and clear priorities for what to fix first.
• An executive report and technical appendix with remediation guidance and explicit unknowns.
• Scope and stop-condition record, evidence manifest and artifact hashes; signed receipt and offline verifier where supported.
• One focused retest of reported findings within 30 calendar days of initial report handover.

Scope and limits

• No exploitation, authenticated application testing, password testing, brute force, credential collection, social engineering, denial of service, destructive activity, persistence, malware, customer-data collection, or data exfiltration.
• No source-code, mobile, smart-contract, cloud-account, IAM, private-network, provider-infrastructure, or open-ended subdomain or IP-range review.
• This is not a penetration test. It is not compliance certification, a security attestation, or a guarantee that the system is secure, complete, compliant, or free of vulnerabilities.
• Targets outside the confirmed first-party scope remain untouched. Third-party or shared infrastructure requires separate written authority.

How to start

1. Request Name the authorised internet-facing system and why the external attack surface matters now. Provide your authority to request the review, but do not send secrets or production evidence.
2. Scope acceptance WitnessOps accepts or rejects the boundary asynchronously, confirms capacity, and records payment. No sales call is required.
3. Review Use passive discovery where applicable, then perform only the explicitly approved, low-impact DNS, TLS, HTTP(S), service-identification, and allowlisted exposure checks against the signed target schedule. Manually validate, deduplicate, prioritise, and link findings to evidence.
4. Delivery and retest Deliver the reports and inspection package. Delivery timing agreed in the signed statement of work. Then retest the agreed reported findings once within 30 calendar days of report handover.