Exposure assessment
Get a clear view of your public attack surface and its potential weaknesses.
Why an exposure assessment?
The external attack surface of a company consists of its systems reachable from the Internet. It is a potential entry point for attackers.
An exposure assessment identifies and maps these exposure points on the Internet, the way an attacker would, so you know exactly what is visible and vulnerable from outside your company.
Objectives
Our audits highlight realistic risk scenarios, including:
Exploitation of Internet-facing flaws
Unauthorized access to critical systems
Theft of confidential data
Compromise of exposed accounts
Detection of forgotten or unprotected assets
The HELX approach
We run external penetration tests to discover and analyze your assets exposed online. Our approach maps the attack surface, identifies the vulnerabilities quickest to exploit and simulates realistic attack scenarios. Our recommendations help you reduce risk, strengthen your defenses and protect your systems against external threats.
Audit types
An exposure assessment can follow different scenarios depending on the initial conditions. During our first conversation, we define together the approach best suited to your specific needs.
Black box
Simulates a realistic attack by an external hacker with no prior access. Our starting point? Your company name. From that single piece of information, we identify your assets and their vulnerabilities.
Gray box
You can share the list of assets you know about so we integrate them into the final map. This saves time and lets us focus our efforts.
Methodology
Our exposure assessments rely on a proven methodology that lets us analyze your entire attack surface. This includes flaws in the configuration of exposed services, application vulnerabilities and authentication mechanisms.
- 01
Public information gathering
Collection of the IP addresses, domain names and subdomains belonging to you through open sources (OSINT) such as Google, Shodan, Censys, Crt.sh and Whois. Retrieval of the employee list and their presence in known data breaches.
- 02
Network and application mapping
Mapping of exposed services (DNS, web, FTP, SSH and more), technologies and their versions. Identification of web application features and sensitive forms.
- 03
Vulnerability research
Identification of common flaws (injections, misconfigurations, software vulnerabilities, outdated components) using specialized tools and manual testing.
- 04
Exploitation
Simulated attacks to validate the identified vulnerabilities, such as taking control of servers or extracting sensitive data. Automated attacks against login forms.
- 05
Post-exploitation
The previous phase gives us access to new information, so we look for and exploit further vulnerabilities in this new context.
- 06
Risk assessment
Classification of the flaws by severity and estimation of the impact on the application and the business.
A bit of technical detail
Our external audit methodology is built partly on proven standards such as OWASP and partly on our experience in penetration testing and Red Team operations. We look for the vulnerabilities that let an attacker break into your IT environment:
- Configuration flaws in network services
- Exposed sensitive files or directories
- Credentials found in data breaches
- Classic web flaws (SQL injection, XSS and more)
- Access control bypass
- Vulnerable application components
- Broken authentication mechanisms
- Exposed development environments
- Brute-force attacks against login pages
- Subdomain discovery
Our other penetration tests
Frequently asked questions
How much does an exposure assessment cost?
From €6,375 excl. VAT for up to about thirty public IP addresses, with the mapping and reconnaissance of your exposed IT environment included. Small businesses, SMBs and non-profits get a 15% discount.
We only have a few IP addresses, is it worth it?
That is often where the surprises hide: forgotten subdomains, services exposed by mistake, reachable admin interfaces. The mapping phase reveals precisely what you do not know about your own exposure.
Can the test impact our online services?
No: no denial-of-service attacks, no destructive actions. Intrusion attempts are carried out with the same care as on an internal production network, and a direct communication channel is agreed for the whole engagement.
How often should we repeat it?
At least once a year, and after any significant infrastructure change (cloud migration, newly exposed application, merger). Your exposure changes constantly, and so do attack techniques.
Tell us about your project.
Let us talk through your needs and expectations and build the right service for you.