Guide
What is attack surface monitoring?
An external attack surface is every host, subdomain, and service an organisation exposes to the internet. It is never static — teams spin up staging sites, marketing launches microsites, acquisitions bring new domains, and forgotten assets linger long after the project that created them. Attack surface monitoring is the practice of continuously re-discovering that surface so new exposure is caught quickly.
Why the surface drifts
Every certificate issued for a subdomain is logged publicly in certificate transparency logs. Every hostname that resolves is observed by passive DNS sensors. The surface grows a little every week, and most of that growth is invisible to the team that owns it.
The dangerous assets are rarely the ones on the asset inventory. They are the staging box with default credentials, the old marketing subdomain pointing at a deprovisioned cloud bucket, the forgotten VPN endpoint. These appear between assessments, which is exactly why a point-in-time scan misses them.
Passive vs. active discovery
Active discovery sends traffic to the target — port scans, service probes, directory brute-forcing. It is thorough but noisy, and it requires authorisation for every host you touch.
Passive discovery reads public records instead: certificate transparency, passive DNS, and public resolution. No packets reach the target, so it can run continuously against any domain without an authorisation workflow. It will not find an unlinked admin panel that never got a certificate, but it excels at the thing that matters for monitoring — noticing what is new.
What good monitoring looks like
The output that matters is the delta: what appeared since last time. A list of 500 subdomains is noise; three new subdomains that showed up this week is a signal worth an alert.
ApexDrift runs passive discovery on a schedule, stores each result, and tells you what changed — so a new asset becomes an email, not something you find during the next engagement.