Purely External Discovery
Purely External Discovery in cybersecurity is a precise, specialized reconnaissance technique that involves identifying an organization's digital assets and security vulnerabilities solely from the perspective of an unauthenticated, external attacker. This method is characterized by strict adherence to collecting information that is publicly available or accessible without using internal network access, privileged credentials, or installed agents.
Key Characteristics and Methodology
Purely external discovery is the foundational process for modern External Attack Surface Management (EASM) because it eliminates the security team's built-in blind spots—the unmanaged assets that an attacker can easily see.
1. Agentless and Unauthenticated Approach
The defining feature is that the process requires no connectors or software agents to be installed on any target systems. It relies entirely on internet-facing communication and publicly available data sources:
Passive Reconnaissance: Gathering intelligence from public sources without directly interacting with the target's assets. This includes analyzing DNS records, WHOIS data, and certificate transparency logs, and searching public code repositories (such as GitHub) for leaked secrets and configuration files.
Active Probing: Performing non-intrusive network scans (like port scanning) against public IP ranges to identify open ports and running services (e.g., exposed SSH, RDP, or database ports) that are answering to external requests.
2. Focus on the External Attack Surface
The assets identified by purely external discovery represent the organization's entire external attack surface, which often includes unknown or unmanaged risks:
Shadow IT and Zombie Infrastructure: Discovering development servers, test instances, or deprecated APIs that are still running and visible on the internet but are unknown to the security team.
Misconfigurations: Identifying common flaws like exposed cloud storage buckets, missing security headers (HSTS, CSP), or out-of-date security certificates on public-facing websites and APIs.
Credential Leakage: Actively searching for hardcoded passwords, API keys, and service account tokens that have been inadvertently pushed to public domains.
Cybersecurity Value
Purely external discovery provides a single, unified view of external risk that is prioritized based on the attacker's actual perspective:
Prioritization: It focuses remediation efforts on flaws that attackers can use for initial access, rather than on internal, low-impact findings.
Objective Measurement: The results are used to calculate objective risk metrics, such as an External Attack Surface Rating, providing a clear grade of security posture for executive leadership.
Continuous Vigilance: Operating continuously ensures that the organization’s dynamic perimeter—constantly changing due to cloud and DevOps practices—is always accounted for and secured.
ThreatNG directly addresses Purely External Discovery by embodying its principles across its entire platform, providing organizations with a continuous, unauthenticated, and attacker-centric view of their attack surface.
ThreatNG's Role in Purely External Discovery
External Discovery and Continuous Monitoring
ThreatNG's core identity is built on performing purely external unauthenticated discovery, meaning it finds all digital assets and risks using zero internal network access, no installed agents, and no privileged credentials. This capability allows it to mimic the initial reconnaissance phase of a cyber attacker with high fidelity. The platform ensures that this discovery process is not a one-time event but is Continuous Monitoring, guaranteeing that the organization's constantly changing perimeter is always accounted for and assessed for risk.
External Assessment and Examples
The findings from external discovery directly feed into ThreatNG's security ratings, which are, in themselves, a quantified assessment of the discovered attack surface:
Cyber Risk Exposure Security Rating: This rating is based on pure external discovery findings, such as invalid certificates and the status of Domain Name Record Analysis (missing DMARC and SPF records).
Example: ThreatNG identifies a subdomain, likely discovered via DNS enumeration, with an expired certificate, confirming a publicly visible configuration error.
Subdomain Takeover Susceptibility: This critical assessment is built on external discovery and DNS enumeration to identify subdomains whose CNAME records point to inactive or unclaimed third-party vendor resources.
Example: ThreatNG confirms that test-blog.company.com points to an unclaimed WordPress service, validating a "dangling DNS" state visible only through external discovery.
Web Application Hijack Susceptibility: This rating is derived from remotely assessing the presence or absence of key security headers, such as Content-Security-Policy and X-Frame-Options, on discovered subdomains, a technique that relies solely on analyzing external HTTP responses.
Investigation Modules and Examples
The investigation modules provide the structured methods used for purely external discovery:
Subdomain Intelligence: This module is essential for external discovery, performing Ports discovery (identifying exposed services like SSH, RDP, MySQL, and Elasticsearch), Header Analysis, and Subdomain Cloud Hosting discovery (identifying hosting on AWS, Microsoft Azure, and Google Cloud Platform).
Example: ThreatNG actively discovers an open RDP port on a test server, confirming a publicly exposed service that an attacker could use for initial access.
Sensitive Code Exposure: This module performs external scanning of public domains to find exposed secrets, which are a significant component of the external attack surface. The Code Repository Exposure submodule finds Access Credentials and Security Credentials (e.g., AWS Access Key ID, Stripe API Key, PGP private key block) in public code repositories.
Domain Intelligence (DNS Intelligence): This module facilitates external discovery by finding IP identifications and performing Web3 Domain Discovery and Identification (proactively checking the availability of .eth and .crypto domains).
Search Engine Exploitation: This module identifies vulnerabilities by finding exposed files and sensitive information via search engine queries, a purely external technique.
Intelligence Repositories and Reporting
ThreatNG's external discovery is backed by threat intelligence and actionable reporting:
Intelligence Repositories (DarCache): This context is vital for prioritizing external findings. The Vulnerabilities (DarCache Vulnerability) repository integrates KEV (vulnerabilities actively being exploited) and EPSS (likelihood of exploitation), allowing the organization to focus on external exposures that pose the highest immediate threat. The Compromised Credentials (DarCache Rupture) repository confirms if a discovered credential has been exposed on the dark web.
Reporting: ThreatNG provides Security Ratings (A-F) and Prioritized reports, translating the complexity of external discovery into clear, actionable metrics for executive leadership and technical teams.
Complementary Solutions
Other security systems can leverage the high-fidelity findings from ThreatNG’s purely external discovery:
Network Firewalls/Access Control Lists (ACLs): ThreatNG identifies all public IP addresses and their exposed ports (e.g., RDP port 3389). This list can be sent to the organization's firewall management system. The firewall system can then automatically use this external data to update ACLs, instantly blocking external access to those exposed high-risk ports and reducing the attack surface.
Vulnerability Management (VM) Systems: ThreatNG discovers an exposed asset running a service with a KEV vulnerability. This external, verified finding is shared with the organization's VM system. The VM system can then use the external discovery and prioritization to immediately launch an internal, authenticated scan to confirm the vulnerability and assign the highest priority for patching.
Security Orchestration, Automation, and Response (SOAR) Platforms: When ThreatNG detects a critical finding from external discovery (e.g., a leaked AWS Access Key ID in a public repository), the SOAR platform can automatically use this alert to trigger a playbook that revokes the key in the cloud provider’s IAM system, closes the repository exposure, and notifies the responsible team.
