# What is reconnaissance in a cyberattack?

Reconnaissance is the attacker gathering information before acting. In MITRE ATT&CK it is the first tactic and covers what happens outside your network: scanning your public IP addresses for open services, collecting employee names and e-mail formats from your website and social networks, looking up your suppliers, and searching for leaked passwords. Much of it is invisible to you, because it uses public sources. What you can do is reduce what it finds: close unused internet-facing services, keep public detail about your IT setup to a minimum, and check whether company addresses appear in known breaches. Scans of your public addresses show up in firewall logs, although they are constant background noise on the internet. Once inside, attackers do a second round of discovery, which is a separate tactic and much easier to see from the network.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-reconnaissance-in-a-cyberattack

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is resource development in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-resource-development-in-mitre-attack)
- [What is initial access in a cyberattack?](https://netsenx.com/en/faq/what-is-initial-access)
- [What does execution mean in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-execution-in-mitre-attack)
- [What is persistence in a cyberattack?](https://netsenx.com/en/faq/what-is-persistence-in-a-cyberattack)
- [What is privilege escalation?](https://netsenx.com/en/faq/what-is-privilege-escalation)