What the internet can see — without jargon

Picture the company as a building. The website is the sign. The login panel for accounting or mail is a door. Remote desktop is the back entrance for a technician. A “temporary” site from 2018 is a window nobody remembers — and the light is still visible from the street.

Exposure is simply what can be noticed or tried from the street (the internet) — without “breaking in” and without scanning other people’s networks. This text is for an owner who does not want a security course, only a short list: what to check in an hour with coffee.

Why it matters

Most problems do not start with “genius hacking”. They start with forgotten things: a test panel, a former employee’s account, an unpatched WordPress, RDP left “for a moment” forever. Attackers look for an easy door. You look for a list of doors that still exist.

You do not need to know ports. You need to know: what the company puts on the internet and who holds a key.

What you can check yourself (5–7 steps)

1. List domains and “company sites”.
   Not only the main site. Campaign landing pages, the shop, a B2B panel, an old blog, a test. or old. subdomain. Put them in a note or the exposure worksheet.

2. Open the hosting / domain panel.
   At the provider (whatever you use) see: which domains are active, which redirects still work, whether there is parking or an old install.

3. Check who has remote access.
   RDP, TeamViewer, AnyDesk, a VPN “for the accountant”, software-house access. For each: who, why, until when. No end date means a decision is due. The remote-access decision tree helps.

4. Find login panels.
   Webmail, shop admin, WordPress /wp-admin, invoicing. Do not test passwords blindly. Write down the address and owner (company / vendor). Later question: can it be reached only from the office or via VPN.

5. Old WordPress and “temporary” sites.
   If someone built a page for an event three years ago and nobody updates it, it is still a door with the company name on it. Take it down or assign maintenance with updates.

6. Accounts of people who are gone.
   Former employee, former bookkeeper, “a friend who helped with the PC”. In Microsoft 365 / Google / hosting: who has a mailbox, who is an admin.

7. One decision per item.
   For each door/window: keep / close / move behind VPN / hand to a vendor under a contract. Without decisions the list does nothing.

What not to do in that hour

• Do not ask “someone on the internet” to scan the company “just to be sure” without a contract and scope.
• Do not paste admin passwords into a help chat.
• Do not delete everything in panic — list first, then decide.

For a deeper, more technical take on attacker mindset and exposure, see Black hats do not start with an exploit. This article is an owner checklist, not an OPSEC course.

Next step

A worksheet and an hour of review often show the gaps. When the list is long or you do not know what to close first — describe the environment on the start path or request a scope quote. The form usually gets a reply within 1 business day; phone is temporarily unavailable.