Attack surface management

Attack surface management

Discover the assets and services an attacker can reach in your environment


Your attack surface is everything an attacker can reach and try to exploit within your scope: IP addresses, hostnames, open ports and the services behind them. BlackNoise discovers it with the network scan events of a campaign, run from the Attack Vector, and presents it as a snapshot of the simulation: what was exposed at the time it ran.
This lets you:
  • Identify the exposed assets and the main services reachable on them.
  • Spot the hosts that expose more than the others , and the ports that appear on many of them.
  • Check what an attacker discovers of the network ranges you choose.


1) Launch a network discovery simulation

Create a campaign from a network discovery scenario: these scenarios run the scan events that feed the attack surface. Define a network scope (IPv4 addresses or CIDR ranges), the Attack Vector and the execution conditions by following steps 1 to 4 on the  Security validation  page. Discovery relies on scan events only, so no connector is needed. See  Scenarios  to find them.
The access to the Attack surface tab depends on your subscription.


2) Read the attack surface

Once the simulation is Completed, open the campaign's  Attack surface  tab. It offers three views of the same results:
  • The table is the inventory: one row per IP address, with its open ports and the information disclosed by each service.
  • The map shows at a glance which hosts expose the most, and lets you filter on a service such as SMB or RDP to see who exposes it.
  • The matrix shows which ports are open on which hosts and which combinations of ports repeat, so that anomalies stand out.
Four key indicators summarize the detected perimeter: the IP addresses detected, the open ports detected, the distinct ports detected and the most frequent port.


3) Reduce your exposure

Use the findings to shrink what an attacker can reach: close or filter the ports that should not be reachable, review the services that disclose information about themselves, and look at the hosts that expose unexpected combinations of ports. The results can be exported as a CSV file.


4) Repeat the discovery

Each simulation records the attack surface as it was when it ran. Replay the campaign regularly with the Create simulation button: every replay scans the same scope again and keeps its own picture, which you open with the Simulation list at the top of the campaign. See  Continuous cyber monitoring  for replaying a campaign.