A company as seen from the internet: exposure and Cybersecurity

October 20, 2026

A company may have a good understanding of its main applications, critical systems and the services it uses every day and still not have a complete picture of what can be seen from the internet.

Its inventories may not include domains created for projects that have already ended, test applications that remain accessible, documents published years ago or information about technologies, employees, suppliers and professional relationships. Although these elements may seem relatively insignificant on their own, when combined they can reveal far more than expected about how a company operates.

This difference between what a company knows it has exposed and what can actually be observed from the outside deserves attention in a Cybersecurity context. Before attempting to gain access to a system, a potential attacker can study the target, identify people and technologies, or locate assets that have fallen outside the usual controls.

■ A company needs a digital presence to conduct its business, but it also needs to understand what it exposes to the outside world, distinguish necessary exposure from unnecessary exposure and identify anything that should no longer remain accessible.

An attack may be preceded by a reconnaissance phase

A cyberattack does not always begin with malware or the immediate exploitation of a vulnerability. It can also begin with a reconnaissance phase aimed at understanding the target and identifying an opportunity.

Part of that reconnaissance can be carried out using publicly available information. Domains and subdomains can help identify services; job vacancies may reveal technologies; professional profiles show roles and connections between teams; and corporate publications may provide information about suppliers, projects or markets.

This information can also be used to prepare social engineering attacks. Knowing who performs a particular role, which supplier a company uses or which project it is working on makes it possible to craft a request that is more closely tailored to the recipient's context.

Alongside this public information is exposure that the company did not intentionally create: an asset that remains accessible after a project has ended, credentials originating from a previous data breach or a misconfiguration in a Cloud service.

The presence of any one of these elements does not in itself confirm a vulnerability or an attack. It becomes relevant when it reveals exploitable exposure, helps make deception more convincing or makes it possible to locate an asset outside the organisation's usual security controls.

■ The expansion of Cloud, hybrid environments, applications, digital identities and third-party dependencies makes it harder to maintain a complete view of the exposed attack surface. Continuous Threat Exposure Management addresses this need by extending visibility and prioritising risks according to their context and potential impact.

Public information becomes more valuable when it reveals exploitable exposure.

Several pieces can tell a story

A hypothetical example helps illustrate this:

—A company publishes a vacancy for a specialist to join a particular project. The job description mentions the technologies they will work with. A professional network makes it possible to identify the head of the area and other members of the team. A search of domains associated with the company reveals a subdomain whose name matches the project.

None of these elements constitutes a security incident on its own. Taken together, however, they provide context about the project, the people involved and part of its technical environment.

If the subdomain leads to a test application that remains accessible from the internet and, in addition, a third party has recently registered a domain very similar to the company's own, the combination of those two findings becomes more significant.

The individual pieces can then be combined into a more complete picture: understanding the project, identifying some of the people involved, locating a technical asset and potentially having a resource that could be used for impersonation.

This does not mean that an attack will take place or that it would succeed. It does, however, show how context can give operational value to information that seemed relatively insignificant in isolation.

■ The reverse can also happen: a company may have identified its critical systems but be unaware that a temporary asset, an old application or a resource managed by a third party is still visible from the internet.

Context can turn seemingly minor data points into useful information for an attacker.

What is visible from the outside does not always match the inventory

Creating digital assets is relatively easy, while decommissioning them properly can be more difficult. A campaign may require a dedicated domain, a development team may temporarily expose an API, an acquisition may bring in systems that previously belonged to another company, a supplier may host a service on the company's behalf, or a test environment may remain connected for longer than intended.

Over time, some of these assets may lose clear ownership, their original context may be forgotten or they may cease to serve a purpose while remaining visible on the internet.

■ This loss of visibility is associated with Shadow IT, the use of technologies or services outside the company's usual approval or management processes. At Telefónica, we identify unmonitored domains and APIs, Cloud misconfigurations and third-party dependencies, among other factors that can increase a company's exposure.

The inventory needs to reflect what the company is actually exposing on the internet.

Not all exposure is equally significant

Identifying the external footprint is only the first step. The challenge is distinguishing which elements serve a business purpose, which require stronger protection and which remain accessible without a clear purpose or with an unnecessary level of exposure.

Making that distinction prevents every form of public presence from being treated as a problem: an accessible service may be legitimate and properly protected; a public document may communicate exactly the information intended; and a professional profile is a normal part of many people's working lives.

The relevance of each element depends on its context: what purpose it serves, who is responsible for it, what information it contains, how it relates to other systems and what could happen if someone used it maliciously.

■ A CTEM (Continuous Threat Exposure Management) approach applies this logic to discover, contextualise and prioritise exposures that pose the greatest risk to the business.

Exposure matters because of its context and potential impact.

Five areas for assessing a company from the outside

To reconstruct this external view, the assessment can be organised into five complementary areas that show what information, assets and relationships a third party might find.

1. Internet-accessible assets

Domains, subdomains, applications, APIs and other services make it possible to assess whether what remains publicly accessible still serves a purpose, has a clear owner and has an appropriate level of protection.

A simple asset count provides an initial reference point, but it is also important to check whether all of those assets are known. An old environment or a domain that nobody recognises deserves attention because it may have fallen outside normal update and monitoring processes.

■ Vulnerability management and attack surface management extend this perspective by linking exposed assets to vulnerabilities and configurations that may increase their risk.

2. Identity and brand

Domains that closely resemble the company's own, fake profiles, applications that misuse a brand or pages that imitate legitimate services may form part of phishing, fraud or impersonation campaigns.

Reviewing them also makes it possible to identify a type of exposure that does not necessarily sit within the company's own infrastructure: resources created by third parties specifically to impersonate the organisation.

■ Digital Risk Protection includes this type of monitoring across the public web, deep web and dark web, as well as threats relating to brand, reputation and online fraud.

3. People and internal structure

Names, job titles, responsibilities and professional relationships are part of the information many companies need to make public. When combined, they can also provide context for making a social engineering attempt more targeted.

People involved in payments, procurement, technical support, systems administration or business decision-making may be more likely to receive social engineering attempts.

■ Professional visibility is a normal part of business activity. The review should focus on what information is available and avoid unnecessary detail about processes, routines or authorisation mechanisms.

4. Documents, repositories and data

Old presentations, technical documentation, shared files, public repositories or content that remains indexed can reveal more information than intended.

The review should determine whether the document still needs to remain public and check whether it exposes technical information, internal data, credentials or metadata that may no longer need to be available.

■ There may also be leaks outside corporate channels. Credentials or information originating from previous incidents may continue to circulate long after the initial exposure occurred.

5. Technologies and third parties

Suppliers, Cloud platforms, development tools and other technologies leave traces in job adverts, documentation, integrations and publicly accessible services.

The existence of this information does not necessarily constitute a risk. However, it can help reconstruct dependencies and guide the search for known vulnerabilities, exposed configurations or resources associated with the technologies and companies involved.

■ The digital footprint therefore extends beyond directly managed systems to include Cloud services, suppliers and other organisations connected to the business. These dependencies should also be considered when assessing third-, fourth- and nth-party risks and potential supply-chain attacks.

The external footprint includes assets, brand, people, data and third parties.

Reducing exposure does not mean disappearing from the internet

A company does not need to hide completely online. Its public presence is part of how it engages with customers, employees, suppliers and markets. Managing that presence requires identifying the elements that increase risk and deciding what protection, remediation or removal each one requires.

So, when an unknown asset appears, the first step is to determine whether it genuinely belongs to the company and who should manage it. If it no longer serves a purpose, it can be removed. If it needs to remain accessible, its configuration and level of protection should be reviewed. A data leak, an impersonation attempt or a fraudulent domain will each require a different response.

When there are large numbers of assets, vulnerabilities or mentions, treating every finding in the same way is unrealistic. The criticality of the asset, its level of exposure and the potential business impact help focus effort on the remediation actions most likely to reduce risk.

■ Continuous Threat Exposure Management (CTEM) addresses this need through a clear cycle: discover what exists, understand what it means, prioritise what matters and then verify whether exposure has been reduced.

Reducing exposure requires discovery, prioritisation and validation.

Conclusion

A company's internal view usually focuses on the systems and services it currently manages. From the outside, however, the internet may also reveal assets and content that are no longer current, depend on third parties or have fallen outside the usual controls.

This gap between the internal view and what can be observed from the outside creates an area of risk that needs to be understood and managed. Understanding that difference makes it possible to decide what should remain visible, what needs stronger protection and what should no longer be accessible.

External visibility is only the starting point

In our whitepaper Revolutionising security operations: Cyber Threat Intelligence and the new CTEM approach, we examine how to contextualise findings, prioritise risks and focus the response on the assets that matter most to the business.