One-off report

Which assets are exposed? External Attack Surface Assessment

We assess, once, what your company exposes on the internet — domains, subdomains, IP addresses, publicly reachable services, legacy systems and shadow IT. From the outside and non-invasively: no exploitation of vulnerabilities, no credentials, no access to your internal network. You receive a report with concrete mitigation measures that management, the security team and an auditor can all work from.

Request a scope →

Typically two weeks from kick-off · scope agreed before we begin

Your asset inventory ends — your attack surface does not.

Forgotten, but onlineOld subdomains, test environments and cloud resources that nobody maintains any more — and everybody can reach.

Growth outruns the inventoryAcquisitions, subsidiaries, agencies and cloud projects create attack surface faster than a CMDB records it.

Auditors want evidenceISO 27001, NIST CSF and NIS2 require documented asset and vulnerability management — not estimates.

A report that holds up — in the boardroom and in the audit.

A comprehensive document that describes your company’s security posture, for IT as well as for management and auditors.

RESULT REPORT — CONTENTS

01Management summaryBoard

02Scope, method & exclusionsAudit

03Attributed asset inventoryIT

04Findings by exploitabilitySecurity

05Shadow IT & legacy systemsIT

06References to standardsAudit

07Next steps & walkthroughAll

Illustrative example · structure, not a real report

Management

Where do we stand?

A clear picture of external exposure and of the few decisions that actually matter — without jargon.

Security & IT

What do we fix first?

Findings prioritised by real exploitability: not every high severity is a high risk. With a concrete next step per finding. Ready for your ticket system from day one.

Audit & compliance

Can we evidence it?

Documented scope, method and exclusions — including parked, third-party and unreachable assets — that an auditor can follow.

Four steps, two weeks.

1Kick-off & scopeYou name domains, IP ranges and legal entities — in any country. We define the scope together before the work begins.

2Confirm assetsWe identify your externally reachable assets and attribute them to you. You confirm what belongs to you — only then does the assessment start.

3AssessmentPassive and targeted active, non-invasive techniques. Prioritisation by real exploitability — EPSS, CVSS, known exploited vulnerabilities (KEV) and exploit data; our security experts validate selected results together with you — without exploits.

4Report & walkthroughYou receive the result report, and we go through it with your team — including the next steps.

CTEMThe four steps match one full cycle of Continuous Threat Exposure Management — scoping → discovery → prioritisation → validation → mobilisation. The assessment runs through it once and gives you a documented baseline.

Scope and price

You tell us the domains to be assessed. From those we determine the externally reachable assets and confirm the scope together with you — before the assessment
Only confirmed assets attributed to your company are charged
The price depends on the number of confirmed assets and follows fixed price tiers. We provide the pricing and billing model on request
No automatic expansion: if the scope turns out larger than expected, we agree the price tier with you beforehand

Not a penetration test — the step before it.

A penetration test proves whether selected systems can be exploited. The assessment first establishes what you expose at all — so that a subsequent pentest targets the right systems.

Attack surface assessment

Comprehensive: all externally reachable assets
Largely automated, manually validated
Non-invasive, very low operational risk
Finds unknown assets — and defines the scope for a pentest

Penetration test

Selective: defined systems or applications
Heavily manual, exploit-based
Potentially invasive, operational risk depending on depth
Proves exploitability

Not part of the assessment: Exploitation of vulnerabilities · authenticated testing with credentials · changes to target systems · scans inside your internal network

ISO 27001, NIST CSF 2.0, NIS2, TISAX

The report is a professional basis for your ISMS, internal risk analyses and contractual security requirements from your customers — and it supports these requirements:

Standard	Relevant requirement	How the report supports it
ISO/IEC 27001:2022	Annex A 5.9 Inventory of information and other associated assets · A 8.8 Management of technical vulnerabilities	Externally reachable assets inventoried and attributed; vulnerabilities identified, prioritised and documented with next steps.
NIST CSF 2.0	ID.AM Asset Management · ID.RA-01 Vulnerabilities identified, validated and recorded	An outside-in view of the systems and services you expose; validated vulnerabilities recorded per asset.
NIS2 Directive (EU)	Art. 21(2)(a) risk analysis · (d) supply chain · (e) vulnerability handling	A dated, documented snapshot as a basis for risk analysis — extended to critical suppliers on request.
TISAX	Assessment preparation	Evidenced asset and vulnerability management for externally reachable infrastructure.

The report replaces neither an audit nor a certification.

FAQ

Frequently asked questions

What do we need to prepare?

Domains, IP ranges and your group structure for the kick-off, plus a contact person who confirms the discovered assets with us. Nothing is installed.

Does the assessment touch our systems?

It is non-invasive and not designed to affect production systems. Alongside passive techniques we run targeted active ones within the agreed scope — no exploits, no authenticated testing, no scans inside your internal network.

Can subsidiaries abroad be included?

Yes. An outside-in analysis is not tied to a location. We define entities and their domains in the kick-off.

Am I committed to anything afterwards?

No. The assessment is a one-off service with a defined scope. Whether you move on to continuous monitoring with GrayScope is a separate decision.

The first step is the scope.

Tell us your domains, IP ranges and legal entities. From those we determine the externally reachable assets and agree the scope with you.

Request a scope →

Good to know

Your attack surface changes constantly.

New systems are added, configurations change, and new vulnerabilities are published every day. If you like, we keep your attack surface in view for you afterwards, on request including that of your critical suppliers.