How do I check what our company exposes to the internet?

Look at yourself from the outside, regularly. List your public IP addresses and domain names, including cloud servers and the office internet connection, then scan them from outside your network with a port scanner you trust, and ask your national CERT whether it offers a notification service for exposed systems. Compare the open ports with what you intended: anything you cannot explain, such as remote desktop, a database, a storage box or a router's admin page, should be closed or moved behind a VPN. Repeat after every firewall, router or cloud change, and check public certificate logs for subdomains you forgot. Scan only addresses you own or are authorised to test. NetSenX does not scan your public addresses. Inside the network it sees inbound connections to monitored hosts, on every plan, so a service that unexpectedly answers outside connections, or a host being scanned or hit by repeated logins, shows up in its traffic.

← All 40 questions on Remote work and exposed servicesAll topics