When is this useful?
Your organisation uses domains, cloud services and applications whose visibility changes over time. An exposure audit establishes what can be observed externally, then checks these observations against assets you recognise. The aim is a usable scope for prioritising further assessment.
Reporting to plan
- A map of observed assets and their ownership links
- Exposure points that need verification
- Treatment priorities with identified uncertainties
Scope, timeline and deliverables are agreed before work begins.
Frequently asked questions
Is this a penetration test?
No. Mapping exposure and testing exploitation are distinct activities. The audit can help select targets for a future penetration test.
Why repeat an exposure review?
Applications, providers and configurations change. A review is a snapshot at a particular time, not a permanent guarantee.