Skip to content

Exposed service

A system or application reachable from the internet that should not be, or should not be reachable without authentication.

Remote desktop published directly, a database with no authentication, a management interface on a public address, or a test environment nobody remembered. These are found within hours of appearing.

Reducing exposure is more effective than defending it. If it does not need to be reachable from the internet, removing that reachability closes the issue permanently.

Where this comes up

Exposed service sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.

Penetration testing Ask an engineer

Related terms

Attack surface Everything about your organization that an attacker could potentially reach and attempt to exploit. Shodan A search engine that continuously indexes internet-connected devices and the services they expose. Port forwarding A firewall rule directing inbound traffic on a given port to a specific internal device. External penetration test Testing performed from the internet against everything you expose publicly.

More in penetration testing

Blue teamBuffer overflowCross-site request forgeryCross-site scriptingCVECVSSCWEDefault credentials

Back to the full glossary →

Want this explained against your own setup?

Definitions only get you so far. Book a short call and we will tell you whether this actually matters for your business, and what we would do about it.

Call (855) 737-9500 / (480) 573-3349

Email [email protected]

15-minute response on critical issues, 24/7. Onboarding in two to three weeks.

We reply within one business day. No spam, no pressure.