Every breach you've ever read about started with reconnaissance. Before an attacker exploits anything, they spend time learning — quietly, passively, using nothing but your domain name and free internet tools.
The unsettling truth? Most businesses have no idea what an attacker can discover about them in five minutes, without ever touching their systems.
What Attackers Can Learn From Your Domain Alone
Start with DNS records. Your DNS is fully public. Anyone can query it. From a simple DNS lookup, an attacker can discover:
- The IP addresses of your web servers
- Your email provider (and which email security you're using — or not)
- Whether you have DMARC, SPF, and DKIM configured (if you don't, your domain can be spoofed)
- The names of your mail servers
- Whether you're running a mail server at all
That's before they've visited your website.
Next: certificate transparency logs. Every time you issue an SSL certificate for a subdomain, it gets publicly logged in a global database called CT Logs. This means an attacker can discover every subdomain you've ever set up — dev.yourcompany.com, staging.yourcompany.com, api-v2-test.yourcompany.com — all of it, in seconds.
Many of these subdomains are forgotten. The developer who spun them up left. The project was cancelled. But the subdomain still points at something — maybe an old server, maybe a cloud service that no longer exists. If it points at a decommissioned service, an attacker can claim that subdomain for themselves and host anything under your brand.
The Passive Scan That Takes Five Minutes
Here's a realistic timeline of what a moderately skilled attacker does before sending a single packet to your servers:
Minute 1 — Domain registration and registrar info
Public WHOIS data reveals when your domain expires (useful for hijacking attempts), your registrar, and sometimes your technical contacts.
Minute 2 — DNS enumeration
Using public DNS resolvers and brute-forcing common subdomain patterns. Tools like subfinder, amass, and dnsx automate this completely.
Minute 3 — Certificate transparency search
A query to crt.sh surfaces every subdomain ever certificated. This typically reveals far more than DNS enumeration alone.
Minute 4 — Internet scan database lookup
Public internet scan databases continuously index the entire internet. A simple query reveals every open port, every service, every software version running on your IP addresses. Your web server, mail server, FTP, databases — all logged, indexed, searchable.
Minute 5 — Technology fingerprinting
Tools like Wappalyzer identify your CMS, framework, analytics platform, A/B testing tools, and chat widgets. Each piece of technology is then cross-referenced against CVE databases for known vulnerabilities.
Why Small Businesses Are Targeted More Than They Think
There's a pervasive myth that hackers only go after big companies. The reality is the opposite.
Large enterprises have security teams, intrusion detection systems, and 24/7 monitoring. A medium-sized business might have a basic firewall and an IT contractor who visits monthly. A small business often has nothing.
Attackers know this. Automated tools scan entire IP ranges and domain lists continuously. When they find an exposed service or a vulnerable software version, they don't care whether it belongs to a Fortune 500 company or a three-person accountancy firm. If it's vulnerable, it gets attacked.
The 2025 Verizon Data Breach Investigations Report found that 46% of all data breaches involved small businesses. The attacks weren't sophisticated — they used known vulnerabilities, default credentials, and publicly visible misconfigurations.
Your Exposure Summary Right Now
Here's what is almost certainly discoverable about your business today, without your knowledge:
| Category | What's Visible |
|---|---|
| DNS Records | IP addresses, mail servers, email auth config |
| Subdomains | Dev, staging, API, and old project environments |
| SSL Certs | Issued certificates and associated hostnames |
| Software Versions | Exact versions of WordPress, Apache, nginx, PHP |
| Open Ports | Any services running on non-standard ports |
| Email Config | Whether you can be impersonated in emails |
| Breached Credentials | Staff email addresses in breach databases |
What You Can Do About It
The first step is simply knowing. Most businesses have never done an external scan from an attacker's perspective. They've never seen what the internet can see.
Running a security scan doesn't patch anything by itself — but it gives you the list. Every exposed service, every misconfiguration, every forgotten subdomain. Prioritised by how much damage it could cause if exploited.
Fix the critical things first. An exposed admin panel with default credentials, a subdomain pointing at a deleted cloud service, an SPF record that allows your domain to be spoofed — these can be fixed in an afternoon. Without ever knowing they existed, they stay open indefinitely.
The internet has already done its reconnaissance on your business. The question is whether you've done yours first.