Ask a South African business owner what their company exposes to the internet and you will usually get a confident answer: the website, and email. Ask the same question after an hour of looking and the number is rarely under eight.
The list grows because the business is working
This is the part that gets missed. An unmanaged attack surface is not a sign of negligence. It is the residue of ordinary activity, and every item on it was a sensible decision when someone made it.
A marketing campaign needed a microsite, so one went up on a subdomain. A rebuild needed somewhere to test, so a staging copy was published and never taken down. A supplier was given a login. A practice manager signed up for a scheduling tool with a company card because the approved one could not do what they needed that week. The bookkeeper was added to a cloud drive. A contractor set up a VPN endpoint and left.
Each of those is defensible in isolation. What nobody owns is the combined list, and the combined list is exactly what an attacker builds before they do anything else.
What the other side actually does
Reconnaissance is not a metaphor. It is a documented, catalogued stage of an intrusion: MITRE ATT&CK lists it as TA0043, the first tactic in the chain. Before anything is attempted against you, someone maps what exists.
That mapping is cheap, automated and indiscriminate. Every address on the internet is scanned continuously by people who do not know or care what your business does. The question of whether you are a target has already been answered — you are, in the same way every house on a street is passed by someone checking door handles. What varies is what they find when they get to yours.
Certificate transparency logs are public by design, which means every certificate ever issued for your domain is discoverable, including the one for the staging site you forgot. DNS records are public. Open ports answer to anyone who asks.
The five doors we find most often
These are not exotic. In order of how frequently they turn up in a first review:
The old site nobody killed. A previous website or campaign page, still online, still running whatever software it shipped with, still carrying your brand. Unpatched for years because nobody remembers it exists to patch.
Subdomains pointing nowhere. A DNS record aimed at a cloud service the business stopped paying for. If the attacker can claim that service, they serve their own content from your domain — a subdomain takeover, and it is common precisely because cancelling a service and removing its DNS record are two separate jobs and only one of them feels urgent.
Admin interfaces on the open internet. Router, CCTV, NAS, database or CMS logins reachable from anywhere. Often with credentials that shipped in the box.
Certificates quietly expiring. Entirely avoidable, entirely visible from outside, and it throws a browser warning at every client on the morning it happens.
Cloud storage left open. A bucket set to public during a migration and never set back. Its contents are indexable, which means they are findable by search rather than by skill.
Why "we have antivirus" does not address this
Endpoint protection defends machines you know about. A firewall defends a perimeter you have defined. Neither has an opinion about a server nobody remembered to include. Tools protect the estate you have described to them, and the gap between the estate you described and the estate you have is where incidents live.
This is why every serious framework starts in the same place. CIS Controls v8 opens with Control 1 and Control 2 — inventory of enterprise assets, then software assets — before it says a word about defence. The NIST Cybersecurity Framework puts asset management under Identify, the first function. Not because inventory is interesting, but because every control after it is scoped to the list, and an incomplete list silently scopes your entire programme too small.
The POPIA angle nobody raises
Section 19 of POPIA requires a responsible party to secure the integrity and confidentiality of personal information in its possession, and to identify all reasonably foreseeable internal and external risks to it. You cannot identify risks to data held on a system you have not inventoried.
This matters in an assessment. If personal information leaks from a forgotten server, "we did not know it was still running" is not a defence — it is a description of the failure. Section 22 then starts a notification clock that runs whether or not you knew the asset existed.
General information, not legal advice. Where an obligation turns on your specific circumstances, take advice from a qualified person.
Getting it written down
The work is not complicated and it does not need to be continuous to start being useful. Four steps:
Discover from the outside. Map what is visible the way anyone on the internet sees you — domains and subdomains, hosts, open services, certificates, exposed interfaces, cloud storage, technologies in use.
Have a person verify it. Automated output is a list of maybes, and a list of maybes gets ignored by the third page. Someone has to confirm what is real and what it would actually cost you.
Write the register. One document: every asset, who owns it, what is wrong with it, ranked by what an attacker reaches for first. Written so a director can read it and an engineer can act on it.
Re-check on a schedule. The list was accurate the day it was made. Business carries on, and the surface grows again — which is the whole point of this article.
Do it yourself, or get it done
Much of the first pass is genuinely DIY-able. List every domain you own and every subdomain you can remember. Check your DNS records against services you still pay for. Search certificate transparency logs for your domain name. Ask each department what tools they use that hold company data. That alone usually surfaces two or three things nobody expected, and it costs an afternoon.
Where it stops being a DIY job is verification and priority. Knowing an admin panel is exposed is one thing; knowing whether it matters more than the expiring certificate is the judgement that turns a list into a plan.
That is what our attack surface discovery and monitoring service does, and it is deliberately separate from a penetration test — a test goes deep on systems you already know about, this goes wide on the ones you may not. Most businesses need the wide view first. There is little sense in testing three applications thoroughly while a fourth nobody remembered sits unpatched on the internet.
One caution, because it matters legally: discovery must only ever run against assets you own or control. Scanning systems belonging to a competitor, a supplier or a former provider is an offence under the Cybercrimes Act 19 of 2020, however the request is framed.
The honest summary
Your attack surface grew this year. It grew because people did their jobs, signed up for tools, launched campaigns and built things. Nothing about that is wrong.
What is wrong is that nobody wrote it down, and the people scanning you did.