Cyber Attack Surface Report

Comprehensive external attack surface report that maps any domain's infrastructure, vulnerabilities, and exposure using 11 sub-actors in parallel. Discovers DNS records, SSL certificates, subdomains, open ports, technology stack, CVEs, CISA Known Exploited Vulnerabilities, GitHub code exposure, and historical drift. Produces a scored Exposure Assessment (0-100) and a letter-grade Cyber Rating (A-F) modeled after commercial security rating platforms.

Features

• Maps full DNS record inventory, SSL certificate transparency logs, and subdomain discovery
• Identifies open ports and dangerous service exposures (FTP, Telnet, RDP, Redis, MongoDB, Elasticsearch) via Censys
• Cross-references detected technology stack against NVD CVE database and CISA Known Exploited Vulnerabilities catalog
• Detects missing email security controls (SPF, DMARC) that enable spoofing attacks
• Scans GitHub for public repositories with potentially sensitive names (credentials, secrets, API keys, config files)
• Tracks historical website changes via Wayback Machine and content monitoring for drift analysis

Use Cases

• Security Teams: Generate a baseline external attack surface inventory before a penetration test. Identify forgotten subdomains, exposed ports, expired SSL certificates, and missing email security controls.
• CISO / Risk Management: Get a quantified Cyber Rating (A-F) and Exposure Score comparable to SecurityScorecard or BitSight for board-level reporting and vendor risk assessment.
• Third-Party Risk Management: Screen vendor and supplier domains for security posture before onboarding. Use the sprawl score and vulnerability data to inform vendor risk tiers.
• DevSecOps Engineers: Find public GitHub repositories with sensitive names, stale unmaintained repos, and technology stack components with known critical CVEs.
• Incident Response Teams: Quickly map the external footprint of a compromised domain, including all IP addresses, subdomains, open services, and certificate history.

How to Use

1. Click Try for free on this page
2. Enter the target domain to analyze (e.g., "example.com")
3. Optionally enable or disable subdomain discovery
4. Click Start and wait for the run to finish
5. Download results from the Dataset tab in JSON, CSV, or Excel

Input Parameters

Parameter	Type	Required	Description
domain	string	Yes	Target domain to analyze (e.g., "example.com")
includeSubdomains	boolean	No	Whether to include subdomain discovery via SSL certificate transparency logs (default: true)

Output Example

{
  "domain": "example.com",
  "generatedAt": "2026-03-13T14:30:00.000Z",
  "executiveSummary": {
    "exposureScore": 47,
    "exposureGrade": "MODERATE EXPOSURE",
    "cyberRating": "C",
    "cyberRatingScore": 68,
    "sprawlScore": 42,
    "sprawlLevel": "MODERATE"
  },
  "assetSummary": {
    "subdomainsDiscovered": 18,
    "uniqueIPs": 7,
    "openPorts": 12,
    "technologiesDetected": 15,
    "cvesFound": 8,
    "cisaKevsFound": 1
  },
  "emailSecurity": { "hasSPF": true, "hasDMARC": false, "risk": "MEDIUM" },
  "vulnerabilities": {
    "detectedTechnologies": ["nginx", "wordpress", "php", "jquery"],
    "cisaKevAlert": "URGENT: 1 actively exploited vulnerability found in detected tech stack."
  },
  "codeExposure": {
    "flaggedRepos": 2,
    "alert": "HIGH RISK: Public repos with credential-related names detected."
  }
}

Scoring Model

The report produces two complementary scores:

Exposure Score (0-100) measures overall attack surface size and risk across four dimensions:

• Infrastructure Exposure (0-30 points): DNS sprawl across many IPs adds up to 6 points. Missing SPF/DMARC adds 5. Large subdomain counts add 5. Expired SSL certificates add 4. Dangerous exposed ports (FTP, Telnet, RDP, Redis, MongoDB) add 5. Excessive open ports add 6.
• Vulnerability Exposure (0-30 points): High-CVE-history technologies (Apache, WordPress, Log4j, etc.) add up to 8 points. Critical CVEs add up to 12. High-severity CVEs add up to 6. CISA Known Exploited Vulnerabilities add up to 15.
• Code and Data Exposure (0-20 points): Public repos with sensitive names (secrets, credentials, tokens) add 8. Large public repo counts add 5. Stale unmaintained repos add 4.
• Historical Drift (0-20 points): Extensive Wayback Machine archives add up to 4. Recent website changes add 3. Large content changes (over 50% diff) add 5.

Cyber Rating (A-F) is a composite letter grade calculated from email security (20%), SSL hygiene (25%), network exposure (35%), and tech complexity (20%).

Exposure Grades: MINIMAL EXPOSURE (0-15), LOW EXPOSURE (16-35), MODERATE EXPOSURE (36-55), HIGH EXPOSURE (56-75), CRITICAL EXPOSURE (76-100).

How Much Does It Cost?

Each run uses approximately $0.10-$0.20 in platform credits depending on the size of the domain's infrastructure. On the Apify free tier you can run approximately 25-40 attack surface reports per month.

Programmatic Access

Python

from apify_client import ApifyClient
client = ApifyClient("YOUR_API_TOKEN")
run = client.actor("ryanclinton/cyber-attack-surface-report").call(run_input={
    "domain": "example.com",
    "includeSubdomains": True
})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

JavaScript

import { ApifyClient } from "apify-client";
const client = new ApifyClient({ token: "YOUR_API_TOKEN" });
const run = await client.actor("ryanclinton/cyber-attack-surface-report").call({
    domain: "example.com",
    includeSubdomains: true
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

FAQ

What is the difference between the Exposure Score and the Cyber Rating? The Exposure Score (0-100) measures the raw size and risk of the attack surface. The Cyber Rating (A-F) is a composite grade similar to SecurityScorecard that weights email security, SSL hygiene, network exposure, and technology complexity into a single letter grade.

What are CISA KEVs and why do they matter? CISA Known Exploited Vulnerabilities are CVEs that CISA has confirmed are being actively exploited in the wild. Finding a KEV match in your technology stack means you have a vulnerability that attackers are currently using, making remediation urgent.

What dangerous ports does the scan look for? The report flags FTP (21), Telnet (23), SMB (445), RDP (3389), VNC (5900), Redis (6379), MongoDB (27017), and Elasticsearch (9200). These services are commonly targeted by automated attacks.

How does subdomain discovery work? The actor queries SSL Certificate Transparency logs to find all certificates ever issued for the target domain and its subdomains. This reveals subdomains that DNS enumeration alone would miss.

Can I use this for continuous monitoring? Yes. Schedule the actor to run daily or weekly via Apify's scheduling feature and integrate with Zapier or Make to receive alerts when the exposure score or cyber rating changes.

Integrations

Use this actor with:

• Zapier for automated workflows
• Make for complex automations
• Google Sheets for spreadsheet export
• The Apify API for programmatic access