A monthly external review can fit in an hour if you keep it to the same eight checks every time: new domains and hosts, certificates, DNS records pointing at nothing, exposed admin pages, open storage, SaaS logins, owners, and removals. The value comes from repeating it, not from depth.
Before you start
Keep one living list of internet-facing assets: name, owner, purpose, and the date last reviewed. The review is a comparison between that list and what you can see from outside.
The checklist
- New names. Look at your DNS zones and at certificate transparency logs for your domains. Anything new since last month should be on your list. If it is not, find who created it.
- Certificates. Note certificates issued for your domains by authorities you do not use. Certificate transparency logs are public, and domain owners can review them to see which authorities issued certificates, when, and for which domains.
- Dangling records. Check for DNS records that point to services you no longer run. Microsoft's guidance calls these dangling entries and notes that CNAME records are especially vulnerable to takeover.
- Admin and management pages. Search your hosts for login pages for routers, firewalls, VPNs, server management and dashboards. If one answers from the open internet, restrict it.
- Storage and test environments. Confirm no bucket, database or staging site is reachable without a login unless that is intended.
- SaaS logins. List the vendor-hosted tools your staff sign in to, and check that each is behind single sign-on where possible.
- Owners. Every line has a named person or team. Lines with no owner go to a short "unclaimed" list.
- Removals. Pick at least one unused item and take it down. Make removal a standing agenda item.
What to record
Write three numbers each month: assets on the list, assets added, assets removed. Over time the added number should be explained by real projects, and the removed number should not be zero.
What to do with findings
- Anything unowned for two cycles gets switched off after notice.
- Anything exposed and unexpected is treated as a possible incident until shown otherwise.
- Anything exposed and intended gets a review of authentication and logging.
Tools
You can do much of this with DNS queries, public certificate log search, and your cloud providers' own inventory views. A dedicated tool becomes worth considering when the list outgrows what one person can review.
Share a two line summary with leadership after each review: what changed and what you removed. A visible habit makes it easier to get a yes when you need an owner to act on something.
Where Safeguard fits
Safeguard covers asset discovery and dependency scanning for the software you build, and its free scan is at gold.safeguard.sh/scan. It is not an external attack surface monitoring product.
Quick check
How long should the first review take?
Longer than an hour, since you are building the list. Later reviews should be much shorter.
Sources
Last reviewed: 19 October 2026.
