Ask anyone who runs a website what their organisation has on the internet, and you will get the main domain. Ask what else, and the answers get vague — a staging site somebody set up for a redesign, a remote-access gateway from before the VPN, a subdomain a contractor pointed at a cloud service in 2019 and nobody has paid for since.
None of that is negligence. It is what happens when infrastructure outlives the person who set it up. The problem is that an attacker does not start with your main domain. They start by finding everything else, because the least-maintained thing you own is the easiest way in.
Working out what you expose to the internet, and watching it as it changes, is a discipline with a name: external attack surface management, usually shortened to EASM. The name is enterprise jargon for a question anyone with a domain should be able to answer.
Here is what it actually involves.
The four questions
Strip away the category marketing and an EASM tool has to answer four things. Everything else is presentation.
1. What do I actually have out there?
This is the part people underestimate. Your attack surface is not your website — it is every name attached to your domain, every address those names resolve to, and every mailbox that can be used to reach your staff.
ClickScan starts from what you tell it you own — domains, IP addresses, mailboxes — and then goes looking for the rest. Subdomain discovery asks your domain's own name servers about the names organisations commonly use, the names your email provider requires, and variations on the ones it finds. Nothing is connected to: every answer comes from a name lookup.
The finding that tends to matter most is the one nobody expects — a name still pointing at a cloud service that no longer exists. Those can be claimed by anyone, who can then serve their own content from your domain, with your name in the address bar and a valid certificate.
2. What is reachable on it, and what is answering?
Once you know the names, the question is what is listening. The port scan reports which ports on a host are reachable from the internet and what is answering on them. The standard sweep covers the ports services are traditionally assigned to and tells you what each one normally carries, saying plainly where it could not confirm what is actually listening; the full-range sweep covers all 65,535 and asks each open port what it is running instead of reading it off the number.
Alongside it sit the checks on how those services are configured: TLS certificates and the protocols and ciphers your server accepts, and the HTTP security headers your site sends to visitors' browsers. Both graded, both with the evidence underneath.
There is one more question in this group that most tools skip. If your domain sits behind a filtering service — the kind that absorbs attacks before they reach you — are all your hosts actually behind it? Subdomain discovery works that out and names the ones answering on their own address, around it. That is a way in that skips the protection you are paying for, and it is the finding owners tend to act on the same afternoon.
3. Can somebody pretend to be me?
Impersonation is an external exposure even though none of it runs on your infrastructure.
Two checks cover it. Email authentication looks at what stops somebody sending mail as you — MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI — with the raw DNS answers in the report and the exact records to publish. The live spoofing test goes further and actually delivers a forged message to your own domain, then reports whether it was accepted. Proof rather than inference.
The Brand Impersonation Monitor handles the other half: domains registered to look like yours. It generates thousands of variations — typos, look-alike characters, compound names, other endings — and resolves each one, then classifies it by what it can actually do. Existing is not the point; a parked domain is not a threat and a live, mail-capable lookalike is. Findings export as STIX 2.1 or YARA for your own blocklists.
4. What is already public about me?
Some of your exposure was catalogued before you ever thought to check. The port checks also report what a public internet-wide index already publishes about your addresses, and the breach check reports which known breaches an address appears in and what types of data each held.
This is what an attacker gets for free, before touching anything of yours.
The part most tools get wrong
Here is the failure that makes attack surface reports untrustworthy, and it has nothing to do with which checks a tool runs.
"We found no lookalike domains" is worth nothing on its own. A sweep where half the answers never came back reads exactly like a clean one. So does a port scan that ran out of time, and a subdomain sweep that gave up early.
Every check that examines a set of things reports the whole set: what was found, what was confirmed absent, what went unanswered, what was not reached, and what was skipped and why. The numbers have to add up to what was attempted. If a sweep could not be completed, you are told that instead of being given a clean result — and you are not charged for it.
That is the difference between a report you can act on and a report you can only hope about.
Two rules about the grade
Every scan gets a letter, A+ to F, and two rules sit under it.
Somebody else's data never sets your grade. Part of a report is observed by a third party rather than by us — what a public index already publishes about your addresses, for instance. It belongs in the report, because it is exactly what an attacker learns for free. It stays out of your grade, which reflects only what we tested ourselves, and those observations are counted separately from your findings.
Every list we look things up in has a date on it. Any list we did not write ourselves carries where it came from, when it was last refreshed and how far we trust it. Data we have not verified can add coverage but cannot raise the alarm on its own. Where a list is too old to rely on, the check says nothing instead of guessing — telling you there is a hole in your defences because our own reference data went stale is the worst way for us to be wrong.
What this is not
Worth saying plainly, because the category is full of tools that imply more than they do.
- It is not internal scanning. Everything here is done from the outside, the way an attacker sees you. Nothing runs inside your network.
- It is not a takedown service. We find impersonating domains, evidence them and export them. Filing with a registrar or a brand-protection lawyer is a separate job.
- It is not a replacement for a penetration test. Automated checks find what is misconfigured or exposed. A tester finds what is exploitable, and chains it. If you need that, ClickSecure AI — the same team — does it by hand.
- We never touch an impersonating domain. Everything about lookalikes is read from public DNS and public certificate logs.
Watching, not checking once
An attack surface is not a thing you audit annually. It changes every time somebody spins up a host, lets a certificate lapse, or registers a domain that resembles yours.
So every check can run on a schedule — daily, weekly or monthly, most of them at a discount — and each run is compared with the one before it for the same asset. You hear from us when something actually moved, leading with what got worse and naming it, rather than an identical email every morning. And when the comparison cannot tell — because the list of names being swept changed — it says so rather than reporting a still-registered domain as fixed.
Starting
ClickScan is live and open to everyone. Create an account with your email address — there is no password and no card — and new accounts get free starter credits, so your first check costs nothing.
Add a domain, run a check, and read the report. If it tells you something you did not know about your own estate, that is the gap this exists to close.