External attack surface is what attackers and scanners can see without insider access. SHELL-AFFECT analyses it as CASP: passive, only with domain authorisation, with a signed report and prioritisation — so you know what matters first.
After a phishing incident leadership wants to “know the attack surface”. CASP Lite on the primary domain shows: old staging subdomain public, SMTP gaps, leaked employee emails in public sources. Priority 1: staging offline, SPF/DKIM, monitoring. No active exploit in CASP; pentest of the customer app recommended as phase 2. Figures and names are anonymised; the flow matches typical engagements.
Outside-in attack surface is a decision basis, not “we hacked everything”. We stay passive, authorised, and prioritising. That is intentional and part of the positioning.
This page’s job: Owns “what is visible outside-in?” (surface picture). Method/kickoff lives on outside-in assessment; DNS-TXT on verification.
Not exhaustive — typical outside-in categories:
Prod, staging, forgotten, takeovers.
Web, mail, VPN, admin panels reachable from outside.
Misconfig, infrastructure hints exposed.
Emails, repos, paste sites — in authorised scope.
When public and attributable to scope.
Internal lateral movement, social engineering without engagement.
Shadow IT, forgotten subdomains, open services, and public artefacts create risk before anyone “pentests”. If you do not know the surface, you prioritise blindly and pay twice later.
Companies with their own domains and digital presence who want to know what is already exposed outside-in before the next budget decision.
“Attack surface” is a buzzword. Often it is only a port scan. We mean authorised outside-in profiling with prioritisation and a report — and we refuse unauthorised or theatrical scans.
DNS-TXT before start — no grey “we will just look from outside”.
What is visible and urgent — not every technical side note at equal volume.
Hardening, audit, or pentest optional and separate — no forced bundle.
Lite/Full publicly oriented — no dumping that makes quality impossible.
Typical CASP/outside-in boundaries:
Authorised outside-in analysis with signed report
Prioritisation and next steps
Declining unauthorised or third-party assets
Active exploitation inside CASP
Full internal network review without a separate audit scope
Finding or certification guarantees
If you want a defensible outside-in map: scope meeting. If you want an anonymous cheap scan without ownership, we are not the fit.
Method boundaries first — no mixed CASP/pentest theatre.
Visible exposure mapped and prioritised.
Authorisation, passive method, analyst, signed report.
Lite/Full in defined day windows.
DNS-TXT and contacts — no deep network access for CASP.
What is visible, urgent, or can wait?
Hardening and test budget follow outside-in reality.
A report that is explainable inside and outside.
Outside-in analysis of authorised domains.
Next steps instead of raw data.
Clear deliverable boundary.
Separate scopes as needed.
Domains, goal, DNS-TXT.
Passive visibility and context.
Risk and actionability.
Handoff and optional follow-ons.
Everything visible and potentially attackable from outside without insider access — domains, services, artefacts.
No. CASP is outside-in and passive. Active work only in separate approved engagements.
Orientation: Lite 10–14 days, Full 14–21 days — depending on scope.
Contact with domains and goal. See Pricing.
Depends on scope and goal. CASP typically focuses technical outside-in exposure of authorised domains; extensions need explicit agreement.
After major changes or on intervals (e.g. re-investigation) when the product/contract includes it — not as a fake subscription pressure.
An outside-in assessment at SHELL-AFFECT is CASP: a passive view of the externally visible attack surface, only after domain authorisation, with analyst accountability and a signed report. Orientation for leaders and IT before budget flows into active testing or unclear tool waves.
Open topic →Automated vulnerability scans produce lists. CASP produces a prioritised outside-in picture with analyst accountability, authorisation, and a signed report. Mixing them buys either too little depth — or too much noise without a decision. For DACH companies the point is clarity before the next budget step, not more PDF volume.
Open topic →CASP and penetration testing are often mixed — that wastes budget. We separate them: CASP is passive outside-in profiling with authorisation; a pentest is active, approved scope with RoE and PoCs. So you know what is worth doing first.
Open topic →Share primary domain and goal — we propose CASP Lite or Full.