Six Sources of Unknown Exposure.
If you don't see it, you can't secure it. Every category below represents assets that exist in your organization's attack surface today but are absent from your inventory.
-
01
Forgotten Subdomains
Staging, dev and legacy subdomains created years ago and never decommissioned. Each one is a live entry point with no owner, no patching schedule and no security monitoring. Attackers enumerate them in minutes.
dev.* · staging.* · legacy.* -
02
Rogue SaaS & Cloud Sprawl
Cloud storage buckets, SaaS tenants and compute instances spun up by individual teams without IT knowledge. No provisioning record, no access policy review and no decommissioning plan: silent accumulation of exposure.
AWS S3 · GCP Storage · Azure Blobs -
03
Orphaned Infrastructure
IP ranges, servers and services inherited from acquisitions, left running after projects end or abandoned during migrations. Orphaned assets carry no internal ownership and typically run unpatched software that IT doesn't know to update.
Acquired Assets · End-of-Project · Migration Remnants -
04
Exposed Dev & Staging Environments
Development and staging environments temporarily made public for testing and never locked back down. They often run with relaxed authentication, debug interfaces enabled and real customer data seeded for testing purposes.
Debug Interfaces · Test Data · Open Auth -
05
Third-Party & Subsidiary Assets
Assets belonging to subsidiaries, partners and acquired companies that share your organization's identity or infrastructure dependencies. Each subsidiary adds its own unknown inventory to your consolidated attack surface.
Subsidiaries · M&A Assets · Partner Infra -
06
CDN & Certificate Exposure
CDN configurations that expose origin server IPs, certificates issued for hostnames that reveal internal naming conventions, and expired certificates that attackers monitor for subdomain takeover opportunities before the organization notices.
CDN Origins · Cert Transparency · Subdomain Takeover
How Does Asset Discovery Turn an Unknown Asset. Into a Risk-Scored Finding?
Discovery, relationship mapping, exposure analysis, risk scoring and ownership resolution all run continuously. Every new asset surfaces with context already attached.
- 01Passive ReconnaissanceCertificate transparency logs, DNS records, WHOIS data, BGP routing tables and web crawl data are ingested continuously. The first footprint is built from public sources, before any active enumeration begins.
- 02Active Asset DiscoverySubdomain enumeration, port scanning, service fingerprinting and cloud API queries extend passive data into a live inventory. New assets are discovered continuously, not on a weekly or monthly scan cycle.
- 03Entity Resolution & Ownership MappingEvery discovered asset is linked to your organization or a specific business unit through registrant data, infrastructure overlap, naming conventions and ASN relationships. Unknown becomes owned: each asset gets an accountability record.
- 04Change Detection & New Exposure AlertingEvery change to the asset inventory triggers a comparison against the baseline: new subdomains, newly opened ports, changed service versions and newly issued certificates surface immediately, not at the next scheduled scan.
- 05Risk Scoring & Remediation PrioritizationEach discovered asset is scored by combining exposure severity, asset criticality, threat landscape context and relationship to high-value targets. Security teams receive a prioritized finding list: not a raw asset dump, but a ranked action queue.
How Does Asset Discovery Find Shadow IT. And Keep the Inventory Continuous?
Continuous asset discovery across domains, subdomains, IPs, cloud assets, CDN configurations and certificates: all linked to your organization with no agents, no integrations and no manual input required.
- Domain & Subdomain DiscoveryContinuous enumeration of all domains and subdomains linked to your organization using certificate transparency, DNS brute-forcing, passive DNS and crawl data.
- IP Range & Port MappingDiscovery and continuous monitoring of all IP ranges associated with your organization, including service fingerprinting and open port tracking across the full address space.
- Cloud Asset DetectionIdentification of public cloud storage, compute instances and services linked to your organization across AWS, Azure and GCP, including resources without internal ownership records.
- Shadow IT IdentificationDetection of SaaS tenants, cloud resources and infrastructure created outside of IT governance, with entity resolution to map each asset back to a business unit or team.
- Certificate MonitoringReal-time monitoring of certificate transparency logs to detect newly issued certificates for your domains, including wildcard abuse and certificates revealing internal hostnames.
- CDN & Infrastructure MappingMapping of CDN configurations to identify origin server exposure, misconfigured routing rules and infrastructure relationships that reveal the underlying stack to external observers.
- Ownership & Entity ResolutionAutomated linkage of discovered assets to your organization, subsidiaries or business units using registrant data, ASN relationships, naming patterns and infrastructure overlap.
- Change Detection & AlertingContinuous baseline comparison to surface new assets, newly opened ports, service version changes and certificate updates at the moment they occur, not at the next scheduled scan.
Find Assets. Before Attackers Map Them.
Passive enumeration finds what's already public. These four AI modules find what belongs to you, predict what will appear next and resolve ownership automatically.
- 01Asset Relationship ModelingInfrastructure overlap, shared certificates, common registrant data and ASN patterns build a graph of asset relationships. One confirmed asset anchors the discovery of dozens of related resources that passive enumeration alone would never surface.
Graph Modeling · Infrastructure Overlap · ASN Correlation - 02Shadow IT ClassifierNaming patterns, hosting characteristics, registration timelines and service fingerprints classify discovered assets as IT-sanctioned or shadow IT. Each shadow asset is flagged with confidence score and probable business unit attribution before human review.
Pattern Classification · Shadow Detection · Unit Attribution - 03Orphan & Abandonment DetectionDeclining traffic signals, unchanged service versions, stale certificate renewal patterns and absence from internal DNS zones indicate asset abandonment. Orphaned assets are flagged before attackers find and weaponize them.
Staleness Signals · Abandonment Flags · Takeover Risk - 04Entity Resolution EngineMulti-signal entity resolution links discovered assets to your organization even when registration data is obscured. Registrant history, IP proximity, certificate subject overlap and naming convention matching resolve ownership without manual verification for most assets.
Multi-Signal Resolution · Registrant Analysis · Naming Patterns
When Exposure Needs Action.
Pick an alert type to preview the first steps of its How To Defend playbook, then open the full playbook.
An unknown exposed asset alert means something tied to your organization is reachable from the internet and your team did not list it. It may be a forgotten subdomain, a cloud server, or an…
- 01SOC analystOpen the alert from the Brandefense asset discovery and shadow IT module and save the hostname, IP address, open ports and the date it was first seen
- 02IT adminCheck the asset against your inventory, DNS zone, cloud accounts and recent change tickets
- 03Cloud engineerSearch every cloud account and billing report for the IP address or hostname
- 04SOC analystCheck what the asset answers on each open port, without logging in
A misconfiguration alert means a setting on something you expose to the internet is risky. Examples are an open admin panel, an unneeded open service, weak TLS, missing email protection records, or a subdomain…
- 01SOC analystOpen the alert from the Brandefense misconfiguration detection module and save each finding with the host, port, record and first-seen date
- 02IT adminConfirm each finding from outside your network with a fresh check
- 03IT adminPut exposed admin panels and management services behind a VPN, single sign-on or an IP allow list
- 04Network engineerClose ports and services nobody can explain
See Your Full Attack Surface. Before Attackers Do.
- Shadow IT and forgotten assets such as old subdomains, staging servers and rogue cloud resources grow faster than inventories.
- You cannot protect assets you do not know about.
- Brandefense Attack Surface Management continuously discovers domains, subdomains, IPs, cloud assets and exposed services.
-
What is asset discovery?+
Asset discovery is finding all the systems, domains and services that belong to your organization and are reachable from the internet. It is the first step of attack surface management.
-
What is shadow IT?+
Shadow IT is any system, app or cloud service used in an organization without the knowledge or approval of the IT or security team. It often has no monitoring or patching.
-
How do you find shadow IT?+
Scan the internet from the outside for assets linked to your domains, brands and cloud accounts, then compare them to your known inventory. Brandefense Attack Surface Management does this continuously.
-
What is the difference between asset discovery and an asset inventory?+
An inventory is the list your teams keep. Asset discovery looks from the outside and finds what is actually reachable, including assets that exist in your attack surface today but are missing from that list. Brandefense Attack Surface Management links each discovered asset back to your organization.
-
What counts as an external asset?+
Anything tied to your organization that can be reached from the internet: domains, subdomains, IP ranges and open ports, cloud assets, certificates, CDN configurations and exposed services, including unknown shadow IT.
-
Does asset discovery need agents or integrations?+
No. Brandefense asset discovery runs with no agents, no integrations and no manual input. It starts from public sources such as certificate transparency logs, DNS records, WHOIS data and web crawl data, then extends that with active enumeration.
-
Why are forgotten subdomains risky?+
Staging, dev and legacy subdomains created years ago and never decommissioned are live entry points with no owner, no patching schedule and no security monitoring. Attackers can enumerate them in minutes.
-
How often is the asset inventory updated?+
Continuously, not on a weekly or monthly scan cycle. Every change is compared against the baseline, so new subdomains, newly opened ports, changed service versions and newly issued certificates surface immediately.
-
How do you find out who owns an unknown asset?+
Entity resolution links each discovered asset to your organization or a business unit using registrant data, infrastructure overlap, naming conventions and ASN relationships, so every asset gets an accountability record.
-
What should I do when an unknown exposed asset is found?+
Treat it as live and reachable until proven otherwise. Find out what it is and who owns it, then secure it or remove it, and do not leave it running while you decide. The How To Defend playbook on unknown exposed assets lists the first steps for the first 24 hours.