Step-by-step method
A reproducible path from question to conclusion.
- 1
Define scope
List brands, domains, subsidiaries, exposed leaders and essential services. Set boundaries and required permissions.
- 2
Build the public inventory
Record known sites, subdomains, official accounts, applications, indexed documents and sensitive-role profiles.
- 3
Find gaps
Look for forgotten assets, inconsistent redirects, obsolete information, lookalike domains and pages disclosing more than needed.
- 4
Assess risk
Consider ease of misuse, plausible impact, exposure of people and existing controls.
- 5
Remediate and monitor
Assign an owner, deadline and proof of correction. Then monitor new domains, accounts and publications that change the surface.
See the surface as a system
A secondary domain may lead to an obsolete login page; a public document may reveal a naming convention; a fake account may borrow an executive’s credibility. Combined, minor elements can enable fraud.
Start with assets and relationships, not a generic vulnerability list. Intrusive testing and active scanning remain out of scope without explicit authorisation.
Prioritise what actually changes risk
Public information does not always need removal. Ask whether it helps identify a target, lend credibility to fraud, reach a service or invade privacy.
Treat high-impact, easy fixes first: abandoned accounts, expiring domains, direct contact details, indexed internal procedures or unclear official channels.
Move from snapshot to monitoring cycle
Exposure changes with each launch, hire, supplier and campaign. A dated inventory, owner per asset and regular review make monitoring useful.
Measure completed remediation, response time and ownerless assets. A short maintained table is better than an impressive map that becomes obsolete.
Common pitfalls
Four shortcuts that weaken the result.
Scanning without permission
Defensive work stays within public observation or explicit authorisation.
Confusing visibility with vulnerability
A public trace is not automatically exploitable; context determines risk.
Forgetting people
Executives, finance teams and spokespeople can become impersonation vectors.
Delivering without ownership
Every fix needs an owner, due date and verification.
Practical questions
Frequently asked questions.
Does a public audit replace penetration testing?
No. It studies observable surface and information risk. Penetration testing requires a technical framework and specific permission.
Should all public information be removed?
No. Balance utility, transparency, duties and risk. Reduction should be targeted and proportionate.
How often should exposure be reviewed?
After material change and according to risk. Sensitive domains, accounts and assets may require continuous or frequent monitoring.
Editorial scope
Written and reviewed by Internet Intelligence Service on 15 September 2026. This educational guide describes a lawful, defensive method. It is not legal advice, an emergency service or authority instruction.