Forgotten internet-facing assets usually show up in seven places: DNS zones, certificate logs, cloud billing, code repositories, SaaS and SSO lists, acquired companies, and marketing or event sites. Check each against your inventory, and anything that appears in one but not the other is a lead.
1. DNS zones
Export every zone you control, including those at registrars that nobody has logged in to for years. Look for records pointing at services that no longer exist. Microsoft's guidance describes how a DNS record left behind after a resource is deleted can be claimed by someone else.
2. Certificate transparency logs
Public logs let a domain owner see which certificate authorities issued certificates, when, and for which domains. A hostname you did not know about often appears here first, because every public certificate leaves a trace.
3. Cloud billing
Billing is an honest inventory: if something costs money, it exists. Compare line items to your list of known services. Small recurring charges are often forgotten test environments.
4. Repositories and deployment configs
Search for hostnames in infrastructure code, CI settings and README files. A staging site from two years ago may still be deployed even though nobody remembers it.
5. SaaS and SSO lists
Tools hosted by vendors have login pages and data, even if you do not run the server. List the apps in your single sign-on tool, then check expense reports and email for sign-up messages from tools not in the list.
6. Acquisitions and old brands
Every acquired company brings domains, accounts and sometimes entire cloud tenants. Add a domain and account handover step to your integration checklist and revisit it after six months.
7. Marketing, events and campaign sites
Short-lived sites for events and product launches are created fast, often by agencies, and rarely removed. Ask the marketing team for a list of every site and tool used over the last two years.
Turning leads into an inventory
For each lead, record:
- The name or address
- What it does, or what it was for
- Who owns it now
- Whether it should still exist
Then act. Reclaim it, put it behind login, or delete it. A list without actions just documents the problem.
Keeping it fresh
Add the sources above as standing inputs. The cheapest improvement is to require that every new internet-facing service is registered at creation with an owner and an expiry date for review.
Where Safeguard fits
Safeguard provides asset discovery as part of its platform and dependency scanning for your code. It is not an external attack surface monitoring service, so use DNS, certificate and cloud inventory sources for the checks above.
Quick check
Which source finds the most?
It varies by organisation. Cloud billing and certificate logs are quick to check and often surface things the other lists miss.
Sources
Last reviewed: 19 October 2026.
