Security consultant recommended an attack surface management tool, is it overkill for a small company?

The consultant is probably an affiliate for that tool and gets a commission. Trying to push continuous attack surface scanning on a company with four addresses is definitely not done in good faith.

Attack surface tools basically just poll DNS records, open ports, cert validity, and service versions on a loop. When you only have a few servers, running an open-source port scanner and reviewing the results yourself won't even take half an hour.

We're a 30-person software shop. We scan our external assets once a month using free open-source scripts. Aside from a single forgotten test subdomain, we've never had any surprises, and it costs us zero.

Your immediate action items are simple: log into your domain registrar, delete any unused subdomains, close unneeded ports on the server, and enforce two-factor authentication across all logins.

Standard security certifications in the UK don't require expensive continuous monitoring tools like this either. An annual basic vulnerability scan alongside an asset inventory is generally considered sufficient.

buying a nice coffee machine for the office with that 7k quid instead of spending it on 4 servers would do the company way more good, totally pointless.

Did the consultant's report highlight any concrete vulnerabilities, or did they just pitch this software as a general recommendation?

Bottom line, this tool is massive overkill for your size. Track your inventory manually, maintain basic security hygiene, and save that budget for authentication vulnerabilities that pose an actual risk.

Looking at it as a process, the picture changes. If you get three different answers on a topic, the question was asked wrong.

Having backups accessible on the same network and with the same identity makes them part of the target. Correct me if I'm wrong.

Could you elaborate on that? If it's your first time, start small; scaling comes later.

If I were you, I'd go this route.

Let me speak from the other side; I'm on the supplier side. Mistakes made on the attack surface management side are usually reversible but expensive.

Of course, it varies if your situation is different.

This thread is archived. Mistakes made on the attack surface management side are usually reversible but expensive.

I'm also curious if anyone does it differently.

To get into the details: If 2FA is on, a stolen password alone is useless.

The real issue isn't the number, but what it's based on. Good luck with that.

We need to make a distinction here. If you scold false alarms, nobody will report again.

Of course, it varies if your situation is different.

Following.

Thanks for writing this, that's the right way. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Good luck with that.

This thread is archived.

Exactly, and not many people know this. The biggest time-waster for us was not knowing who had the final say.

Most incidents start with a leaked password, not a vulnerability. This is my opinion, I'm not claiming it's absolute truth.