A working glossary, and the research we are writing next.

Every point at which an outsider could interact with your systems: domains, IP ranges, exposed services, cloud storage, APIs, SaaS tenants and the credentials that open them. The external attack surface is the portion an attacker can enumerate with no access at all, which is why it is the part worth mapping first.

Applies to: Attack surface

The practice of discovering that external estate from the outside in, attributing each asset to an owner, and watching it for change. It answers “what do we have facing the internet” rather than “is this host we already know about patched”.

Applies to: Attack surface

The category term for monitoring threats that sit outside your perimeter — leaked data, impersonation, exposed assets, targeted executives. It spans dark web monitoring, attack surface management and brand protection, which is why those three are usually bought together.

Applies to: Dark webAttack surfaceBrand

Sites reachable only through an anonymising network such as Tor or I2P, where stolen corporate data is traded with little fear of removal. In practice the useful intelligence also sits on the clear web next door: paste sites, breach forums, closed Telegram channels and ransomware leak pages.

Applies to: Dark web

A criminal specialist who breaks into an organisation and then sells that access on rather than using it. An advert naming your company — or describing your sector, revenue and VPN vendor closely enough to identify you — is often the last warning before ransomware arrives.

Applies to: Dark web

Malware that harvests saved browser passwords, session cookies, autofill data and wallet files from an infected machine and uploads the lot; the resulting file is the stealer log. Because infection usually happens on a personal or unmanaged device, one employee can expose a live corporate SSO session without anything touching your network.

Applies to: Dark web

A plain-text file of email-and-password pairs compiled from many different breaches and stealer logs, then recirculated. Because it is a compilation, an appearance tells you a credential is in circulation but not where it came from — so provenance matters far more than a raw hit count.

Applies to: Dark web

Replaying stolen username-and-password pairs against your login pages at scale, on the assumption that people reuse passwords. It exploits reuse rather than any flaw in your code, so the defences are MFA, detection of anomalous login patterns, and resetting exposed credentials before anyone tries them.

Applies to: Dark webAttack surface

Registering a domain one keystroke or one word away from yours: a dropped letter, a swapped top-level domain, an added hyphen, or an appended word such as “login” or “payroll”. The registration itself is cheap and often legal; what follows it is usually phishing, invoice fraud or a fake support page.

Applies to: Brand

A lookalike domain built from characters that render almost identically to yours, frequently Unicode letters from another script encoded as punycode (xn--…). To someone reading the address bar it can be indistinguishable, so detection has to compare rendered glyphs rather than raw strings.

Applies to: Brand

What happens when a DNS record still points at a cloud service that no longer hosts anything — a deleted bucket, a decommissioned app, a retired CDN endpoint. Anyone can register the abandoned name at that provider and serve their own content from your subdomain, with a valid certificate to match.

Applies to: Attack surfaceBrand

A set of public, append-only logs that publicly trusted certificate authorities write to whenever they issue a certificate. Because the logs are open, they double as an early-warning feed: new hostnames of your own appear there, and so do certificates issued for domains built to impersonate you.

Applies to: Attack surfaceBrand

Getting malicious content removed by whoever has authority over it: the registrar, the hosting provider, an app store, a social platform or a national CERT. Success depends on filing with the right party in the format that party accepts and then chasing it, and how long that takes is decided by the provider rather than by the person filing.

Applies to: Brand

Systems that teams stand up without going through IT or security: a campaign microsite, a departmental SaaS trial, a developer's personal cloud account holding production data. It is rarely malicious, but it is unmonitored and unpatched, and it is almost always found from the outside rather than in an asset register.

Applies to: Attack surface