What is an external attack surface scan, who needs one and what does it cost?

What exactly is an attack surface?

The attack surface is the sum of every entry point an attacker could try in order to reach you. The internal attack surface covers systems reached from the inside, such as staff computers, the internal network and Active Directory. The external attack surface is the part anyone on the internet can see:

• Domains and subdomains (including forgotten records such as vpn., mail., test., old-portal.)
• Open ports and the services running on them (RDP, SSH, databases, remote management)
• Web applications, admin panels, API endpoints
• Email infrastructure: SPF, DKIM and DMARC records, and the spoofing risk created when they are missing
• TLS certificates, including expired or misconfigured ones
• Lookalike / typosquat domains that imitate your brand

Most attacks do not start with a sophisticated zero-day but with a forgotten item on this list: an unpatched VPN appliance, a domain without DMARC, a test server nobody remembers.

How is the scan done, and can it harm our systems?

There are two levels, and the difference between them matters:

Passive assessment reads only public sources: DNS records, Certificate Transparency logs, WHOIS, search engines. Not a single packet is sent to your systems, so it needs no permission and carries zero risk of downtime. The Fjordex connector (MCP) works at this level.

Active assessment performs port scanning, service version detection and known-CVE matching; it connects to your systems but does not run exploits. It requires written authorisation, and the test window is agreed together.

Beyond these comes penetration validation: manual, non-destructive validation of the critical findings. This step is carried out only under signed Rules of Engagement and an NDA, and is priced separately.

Who should have one?

The short rule: if you have anything exposed to the internet, you have an external attack surface, and someone is already scanning it. The most urgent cases are:

• SMEs (Northern Cyprus and Türkiye): Most have no IT team, infrastructure is spread across outside providers, and nobody sees the whole picture. The most common findings: fake invoice emails can be sent in the company's name because DMARC is missing, RDP is exposed to the internet, and subdomains have no clear owner.
• Universities: Dozens of faculties, hundreds of subdomains, student projects, services that were shut down but are still in DNS. The attack surface is large and scattered; building the inventory is valuable on its own.
• Hospitals and clinics: Patient data, KVKK/GDPR obligations and operations that cannot tolerate downtime. The fact that a passive scan affects no system at all is a decisive advantage here.
• Municipalities and public bodies: Citizen services, heavy reliance on email correspondence and reputational risk.
• Organisations facing cyber insurance or tender requirements: Insurers and large customers increasingly ask for an independent external assessment report.

What does it cost? ArveNova prices

The figures below are starting prices, in EUR and excluding VAT. The final price is given in writing once the number of assets and the scope are confirmed in a scoping call. Tiers can be purchased separately or together; every engagement starts with a written scope and a signed authorisation (ROE).

What does the price depend on? On the external side, on the number of internet-visible assets: domains, subdomains, public IPs and services. Headcount or the number of computers does not directly set the external price; Tier 3 (Active Directory) is priced by user and campus count, Tier 2 by the number of platforms.

Penetration test: a separate engagement, not part of the tiers above. Scenario, methodology and deliverables are defined in writing for each project; scope and price are set in the quote. Request a quote.

Continuous monitoring: 24/7 monitoring through an agent installed on your endpoints, a separate service from Tier 4. Scope, start date and price are set in the quote. Request a quote.

What does the report look like? A sample finding

Every finding has the same structure: title, severity (calculated from the CVSS vector, never assigned by hand), confidence level, evidence, the attacker's view (RED) and the fix (BLUE). A format sample from the signed report (not a real run):

[F-03] Outdated web component, Apache httpd 2.4.49
  Severity: Critical (CVSS 9.8, NVD primary)
  CVE: CVE-2021-41773 · CWE-22
  Confidence: CONFIRMED · Asset: https://target.example:443
  RED: Path traversal, remote file read conditions.
  BLUE: Upgrade to version 2.4.51 or later.

CVE matching works by comparing the detected service version with an NVD-based CVE dataset; matches that rely on a version range are kept apart with an "unconfirmed" label, and assets behind shared hosting or a CDN are not matched to CVEs. The second sample below comes from an email security check in the Fjordex connector:

{
  "id": "email.dmarc_missing",
  "title": "No DMARC record",
  "severity": "high",
  "evidence": "No TXT record found for _dmarc.example-company.com.",
  "recommendation": "Start reporting with p=none, move to p=quarantine after 2-4 weeks, then to p=reject.",
  "category": "email"
}

What this single line means: right now anyone can send fake invoices to your customers from accounts@example-company.com, and the receiving mail servers will not reject them. The fix is one DNS record, but if nobody points it out, it stays open for years.

How often should it be repeated?

The external attack surface is not static: a new SaaS subscription, a subdomain opened for a marketing campaign, a change of hosting provider, all of these change the surface. Practical advice: one full assessment a year (Tier 1), with monthly delta monitoring in between (Tier 4). For large surfaces such as hospitals and universities, monthly monitoring is worth more than a one-off scan, because problems usually appear in items that were "newly opened".