How far can I go scanning on my own with open source attack surface management?

Keep rate limits in mind when scanning actively. If you run a scan pushing hundreds of packets per second, your data center's IDS/IPS will isolate your server automatically. Run your scans single-threaded with sensible delays between requests.

Open source tools will only tell you if a door is unlocked. They won't tell you how the data behind that door could be exfiltrated or how two separate services chained together might create an exploit. Don't let yourself fall into a false sense of security.

Last year I ran a similar open-source scanner on our server in Berlin. An hour later we got a malicious activity warning from the hosting provider and our server traffic was suspended. Our systems were down for half a day until we managed to explain the situation.

As a first step, start with passive recon tools. Without sending a single packet to any server, you can catch dozens of forgotten subdomains and old test pages just from public internet records. Shut those down first.

i wouldnt recommend launching aggressive scans without notifying the data center in advance and whitelisting your ips, or youll end up dealing with the abuse department.

Are the servers you use entirely dedicated machines belonging to you, or are they shared cloud instances? In shared environments, rules are far stricter due to the risk of impacting other customers in the same IP block.

Even if it is your own property, do not run active vulnerability scans at the network layer without formally notifying your data center.

Let me share my experience. The answer varies greatly by industry; there is no one-size-fits-all rule.

Don't hesitate to ask; those who don't ask always pay more. That's all, sorry if I went on too long.

I have a question. Having backups accessible on the same network and with the same identity makes them part of the target.

I didn't know that. The answer varies greatly by industry; there is no one-size-fits-all rule.

I'm in the same situation that's why I'm asking. honestly mistakes made on the open source attack surface side are usually reversible but expensive.

If I were you, I'd go this route.

We need to take it step by step. Security isn't absolute; it's about making attacks not worth the effort.

Payment information changes are never verified through the channel they came from. That's all, sorry if I went on too long.

I disagree with you on this point. Having backups accessible on the same network and with the same identity makes them part of the target.

When making decisions, write down the worst-case scenario too, not just the best. Proven by experience.

Absolutely. If I were to add anything: If permission and scope arent in writing dont start that test.

If I understood correctly, you're saying: Mistakes made on the open source attack surface side are usually reversible but expensive.

Correct.

Let me summarize the topic since several different answers were given... anyway security isn't absolute; it's about making attacks not worth the effort.

Proven by experience.

Here's how it went for us. Most incidents start with a leaked password, not a vulnerability.

Of course, it varies if your situation is different.