External attack surface

The external surface almost never matches the inventory. The gap is produced by the same four mechanisms in nearly every organisation: pre-production environments published “temporarily”, subdomains pointing at third-party services that were cancelled, deployments made by product teams outside the infrastructure process, and acquisitions whose perimeter was never integrated.

Measuring it is a continuous discovery problem rather than a scanning problem. An inventory that is correct on day one stops being correct within weeks, and what matters is not the snapshot but the drift: what appeared since the last review, and who published it.

Seen from outside, a third party’s surface is also one of the few maturity signals you can observe without their cooperation. A reachable administration panel or an expired certificate says more about their real operations than twenty questionnaire answers.