The Attack Surface You Don’t Know You Own.

When a security team says “we monitor our external attack surface”, it almost always means “we monitor the external assets we know about”. The two aren’t the same thing. The gap between them is where exposures sit unnoticed.

The shape of the gap differs from one organization to the next, but five patterns keep producing it.

Five Places the Inventory Falls Behind

Acquisitions Arrive With Infrastructure

Companies that grow through acquisition inherit infrastructure that rarely makes it into the central inventory. The acquired company’s main domain gets noticed. Its regional subsidiaries, partner integrations, event microsites and the assets of the companies it had acquired usually don’t.

The infrastructure persists. The documentation doesn’t catch up.

Campaigns Outlive Their Teams

Microsites for product launches, conference sites, regional campaigns and short-lived promotions get registered fast and forgotten faster. The team that registered them has moved on. The DNS records still resolve, the certificates still renew, and the host still answers: live, reachable and missing from the inventory.

Retired Systems Keep a Second Life

A system retired years ago can still answer DNS queries because nobody removed its records. A subdomain whose CNAME points at a third-party service you no longer pay for still routes traffic to whoever holds that service name now. If someone else can claim that name, they can serve their content under your subdomain: a subdomain takeover.

Subsidiaries Run Their Own IT

Large groups with subsidiary brands often run separate IT operations per subsidiary. The group CISO sees the parent clearly and the subsidiaries unevenly. Attackers don’t respect that boundary: to them, a subsidiary is a path into the parent.

Shadow IT Adds Up Quietly

Teams spin up cloud infrastructure on a corporate card. Marketing runs its own analytics stack, and engineering keeps experimental services alive after the experiment. Each instance is reasonable on its own; together they form an inventory nobody maintains.

Discovery Is Not Scanning

The inventory gap is what separates discovery from scanning. Scanning runs against an inventory; discovery finds what the inventory missed. Both are necessary, and treating discovery as a one-time onboarding step misses the point, because the gap reopens whenever someone registers a domain or stands up a host.

In practice, discovery starts from a seed, usually the parent domain, and follows every relationship an index of the internet can see. That means subdomains from passive DNS and certificate transparency, the IP addresses they resolve to, and the other domains that share those addresses, mail servers, name servers or registrant details.

In the Deepinfo Platform this is Asset Discovery. Candidates land in a review queue unless you let a rule approve them, because a shared IP address suggests ownership without proving it. That logic applies one level up: a group that wants to see its subsidiaries the way an attacker does runs discovery from each subsidiary’s own seeds as well as the parent’s.

Where to Start

For a team starting an exposure management program, the practical first move is a discovery run against the parent domain. You already know that domain; the point is that the output shows you the size and shape of your own gap. In the runs we see, the discovered inventory is larger than the starting one, and while the difference depends on the organization’s size and history, the direction is consistent.

The starting inventory is only the floor. The work is closing the gap continuously, because the gap reopens continuously.