External assessment
External attack surface assessment checklist
Who this guide is for
SaaS teams, SMBs, agencies, MSPs, and consultants establishing an outside-in security baseline.
Key takeaways
- Authorization and scope come before discovery.
- Asset ownership matters as much as asset discovery.
- Validate material findings before escalation.
- Separate exposure from proven exploitability.
- Track surface changes after remediation.
Scope and authorization
Record the legal owner, authorized domains and IP ranges, prohibited techniques, testing window, contacts, rate limits, and escalation procedure. Passive discovery can reveal related assets, but newly discovered systems should not automatically become authorized targets.
Asset and service discovery
Review domains, subdomains, DNS, certificates, hosting relationships, public applications, APIs, remote-access services, administrative interfaces, cloud storage exposure, and technology signals. Confirm whether each asset is active, owned, expected, and maintained.
Configuration and exposure review
Assess TLS, redirects, security headers, email authentication, public services, obvious administrative exposure, abandoned assets, and other externally observable conditions. Where safe and authorized, validate important results to reduce false positives.
Prioritization and next actions
Rank findings using exposure, asset importance, plausible impact, ease of misuse, confidence, and available safeguards. Assign immediate containment, configuration remediation, ownership investigation, monitoring, or deeper manual testing.
Recommended workflow
- Document authorization and constraints.
- Discover and verify assets.
- Review services and configurations.
- Validate material findings.
- Assign remediation and monitoring.
Use the worksheet
Turn the guide into an owned process.
Open the printable checklist for this topic, assign the missing owners, and record the evidence or decision behind every completed item.
Open printable checklistFrequently asked questions
Is attack-surface assessment a penetration test?
No. It emphasizes discovery and exposure. A penetration test uses an authorized methodology to test weaknesses and attack paths more deeply.
Can every discovered subdomain be tested?
No. Discovery does not establish ownership or authorization; scope must be confirmed.
How often should it run?
Use a cadence proportionate to change and risk, with additional reviews after launches, migrations, acquisitions, or major DNS and infrastructure changes.
Sources and further reading
This guide provides general operational information. It is not legal advice, a certification, or a substitute for a qualified security assessment scoped to your organization.