Your attack surface is everything exposed to the internet that an attacker could potentially use to gain access to your business. Most NZ small businesses have a larger attack surface than they realise — and don't know what's in it.
Before an attacker targets your business specifically, they typically scan your publicly visible assets — everything that's internet-facing and might provide an entry point. This scanning is automated and continuous. Security researchers and threat actors run scanners that index the entire IPv4 internet space in hours, cataloguing every open port, every exposed service, every web application, and every SSL certificate.
Shodan (shodan.io) is a publicly accessible version of this intelligence — a search engine for internet-connected devices and services. Search your business's IP ranges or domain on Shodan and you'll see exactly what attackers can see about your internet-facing infrastructure.
Common Attack Surface Elements for NZ SMBs
Web applications: Your business website, customer portals, and any web-accessible business systems. If a web application has an authentication page, it's being scanned for credential attacks. If it runs on a common platform (WordPress, WooCommerce, Magento), it's being scanned for known vulnerabilities in that platform's plugins and themes.
Remote access: VPN concentrators, Remote Desktop Protocol (RDP) exposed to the internet, Citrix gateways, and management interfaces. RDP exposed to the internet is one of the most reliable attack vectors for ransomware — automated scanners find open RDP ports and attempt credential attacks continuously. If your business has RDP accessible from the internet without IP restrictions, it is actively being attacked right now.
Email infrastructure: Your email server or Microsoft 365 login page. Microsoft 365 login is the target of credential stuffing attacks at enormous scale. This is why MFA is non-negotiable for any internet-accessible business email.
Supplier portals: Any external portals your business uses for supplier management, accounting, or industry-specific software. These are part of your supply chain attack surface — if a supplier portal is compromised and you access it, you may be exposed to malware or credential theft through the trusted connection.
Forgotten assets: Old websites, staging environments, development servers, and cloud resources that were created and not decommissioned. These accumulate over time and often run outdated, unpatched software — making them attractive easy targets. A forgotten staging site running an unpatched WordPress installation from 2018 is a real entry point into your business infrastructure.
Reducing Your Attack Surface
The principle of attack surface reduction is straightforward: if something doesn't need to be exposed to the internet, don't expose it. RDP should never be accessible from the internet directly — use a VPN or Azure Bastion. Admin interfaces should be restricted to specific IP ranges. Unused cloud resources should be decommissioned. Old websites should be taken down.
Optimyze conducts attack surface assessments as part of onboarding new managed IT clients — identifying every internet-facing asset, mapping what's exposed, and producing a prioritised remediation plan.
You can't defend what you don't know about. An attack surface assessment answers the question attackers are already answering: what can we reach, and what does it run?
