What is Attack surface?
Everything an attacker could reach and probe — every domain, subdomain, API, login, parameter and shadow asset exposed to the internet.
Attack surface: Everything an attacker could reach and probe — every domain, subdomain, API, login, parameter and shadow asset exposed to the internet.
In plain language
Your attack surface is bigger than your main app: forgotten subdomains, staging environments, old APIs, third-party integrations and shadow assets nobody is tracking. Attackers map all of it; a test that only looks at the known app misses where incidents start.
SuperPentest maps the surface first — including shadow assets found through keyless passive OSINT — within your authorized scope, so testing reaches what attackers would actually find. A pentest is a photo; your surface is a film.
A concrete example
Your main app is hardened, but a forgotten staging.acme.com runs an old build with debug mode on, and a years-old api-v1.acme.com still answers. An attacker finds both through passive DNS before touching your front door. SuperPentest maps these shadow assets first, within your authorized scope, so testing reaches the exposure that actually gets exploited.
Related
Continuous pentesting → · Subdomain takeover testing →
Want this tested on your app? Book a demo or read how findings are verified.