In Part 2a of this series, you learned how to find and fix security problems hiding inside your systems. Now it’s time to look outward at what attackers see when they scan your business online.
Your external attack surface includes everything visible online: your email, website, cloud services, and remote access points. Attackers try these doors first because they’re accessible from anywhere in the world. Insurance companies scrutinize these external systems because most breaches start there.
The good news: external security problems are often easier to find than internal ones because specialized scanning tools can check your entire internet presence in minutes. The challenge is knowing what to scan for and how to interpret the results.
This guide shows you how to find vulnerabilities in your online presence and close them before insurance audits or attackers discover them.
Email Security: Your Most Vulnerable Entry Point
Email remains the primary way attackers break into businesses, and the financial impact is significant. Verizon’s 2026 Data Breach Investigations Report shows that successful Business Email Compromise (BEC) attacks result in a median loss of roughly $50,000, with individual losses reaching up to $10 million. When you factor in business interruption losses from email-related breaches, the median jumps to $90,000. Your email security determines whether these attacks succeed or fail.
Incomplete or Missing Email Authentication
Email authentication protocols (SPF, DKIM, and DMARC) tell receiving servers that your emails are legitimate. Without them, anyone can send emails that appear to come from your domain. Attackers use this to trick your customers, vendors, and employees.
The five-minute check: Run your domain through MXToolbox’s DMARC checker. You’re looking for three specific records: an SPF record listing authorized mail servers, DKIM signatures proving your emails aren’t forged, and a DMARC policy telling servers what to do with unauthorized emails. Missing any of these means your domain is vulnerable to spoofing.
Getting it fixed: Your email provider has setup instructions specific to their service. Microsoft 365 users follow Microsoft’s SPF setup guide. Google Workspace users follow Google’s DMARC configuration.
The process typically takes 30-60 minutes.
If you use multiple email services (marketing emails through Beacon Broadcast, transactional emails through MailGun, etc.), include all of them in your SPF record.
Start with DMARC in monitoring mode (p=none). After two weeks of clean reports, switch to enforcement mode (p=quarantine or p=reject).
Legacy Authentication Still Enabled
Many businesses still allow “basic authentication” where applications use only usernames and passwords without any additional security. Modern attackers scan for businesses that still accept legacy authentication because it’s an easy way in.
Where to look: Navigate to your email admin console’s authentication settings. Microsoft 365: Azure Active Directory > Security > Authentication Methods. Google Workspace: Admin Console > Security > Authentication. Look for “Basic Authentication” or any protocols that don’t require multi-factor authentication.
Closing this door: Before you disable anything, identify which applications currently use legacy authentication. Your admin console shows recent sign-ins and the authentication method used.
Update or replace those applications first. Then disable legacy protocols through your admin console. Microsoft 365 admins use conditional access policies to block it entirely. Google Workspace admins enforce modern authentication requirements through security settings.
Yes, some applications will break. That’s the point. If an application can’t work with modern authentication, it’s too insecure to keep using.
Hidden Email Rules and Forwarding
Attackers who compromise an email account often create hidden rules to forward copies of emails, delete security alerts, or move messages to obscure folders. These rules persist even after you change the password.
The systematic audit: For Microsoft 365, use PowerShell to export all inbox rules across all mailboxes. For Google Workspace, check Gmail settings > Filters and Blocked Addresses for each user.
Red flags: rules forwarding to external addresses, rules deleting messages from security teams, rules moving emails to obscure folders, or rules triggering only for specific senders.
Cleaning up: Delete suspicious rules immediately. Note when each rule was created and who created it. If you find compromised rules, force a password reset with two-factor authentication. Check mailbox delegates and send-as permissions.
Spoofable Subdomains
Many businesses properly secure their main domain but forget about subdomains.
Finding forgotten subdomains: Use MXToolbox to test each subdomain.
To find all your subdomains, log into your domain registrar (where you purchased your domain name) and review your DNS records. Look for A records, CNAME records, and MX records pointing to subdomains. If you’re not comfortable doing this yourself, ask your web developer or IT provider to generate a list of all active subdomains. Old, forgotten subdomains are prime targets because nobody monitors them.
The fix: Add SPF and DMARC records for every subdomain. For unused subdomains, set DMARC to “p=reject”.
Website and External Attack Surface
Your website and related infrastructure create additional entry points for attackers. Insurance companies want proof you’ve secured these public-facing systems properly.
Exposed Remote Access Ports
Remote Desktop Protocol (RDP) and Secure Shell (SSH) let you manage servers remotely. When these services are directly exposed to the internet, attackers can try to break in by guessing passwords or exploiting vulnerabilities. According to Censys’s research, millions of RDP and SSH services remain directly accessible online despite known risks.
See what attackers see: Use Censys.io to scan your public IP addresses. Create a free account for the community edition, which provides limited searches per month and should be enough to check your own infrastructure.
Search for your IP address or company name. Censys shows which ports are open and what services are exposed. For more detailed scans or frequent monitoring, paid plans start at $99/month, but the free tier works well for periodic security checks.
Look specifically for port 3389 (RDP), port 22 (SSH), port 5900 (VNC), or other remote management protocols. If Censys lists your servers, every attacker on the internet can see them too.
The only acceptable solution: Close these ports to internet traffic. Set up a VPN for remote access and configure your firewall to allow RDP/SSH only from the VPN’s IP address range. This isn’t optional if you want cyber insurance.
If you absolutely must allow direct internet access (and you shouldn’t), use IP allowlisting.
WordPress Sites with Security Drift
WordPress powers many business websites, but maintaining WordPress security requires ongoing attention.
Your WordPress security checklist:
Check Dashboard > Updates for anything outdated. Review Users > All Users for old accounts. Check Plugins > Installed Plugins and remove anything marked “inactive.” Run your site through Sucuri’s free scanner to check for known malware, or install Beacon Web’s Defender Pro.
Immediate actions: Update everything, starting with WordPress core. Before making updates, take a complete backup.
Delete old admin accounts completely. Install a security plugin like Wordfence or WPMU DEV Defender (included with Beacon Web’s hosting accounts) to handle ongoing scanning and firewall protection. As detailed in our website security guide, these basic protections stop most automated attacks.
Missing Web Application Firewall
A Web Application Firewall (WAF) sits between your website and visitors, blocking malicious traffic before it reaches your site. Without one, every attack attempt hits your server directly.
Quick assessment: Review your hosting setup to see if you already have WAF protection. Beacon Web Hosting includes a WAF. Cloud services like Cloudflare, Sucuri, or AWS WAF sit in front of your site and filter traffic before it reaches your server. Server-based options like ModSecurity run on your web server itself.
Adding protection: For immediate, free protection, set up Cloudflare’s free plan. This provides basic WAF rules, DDoS mitigation, and performance improvements.
For WordPress sites handling sensitive data or e-commerce, consider Sucuri’s website firewall starting at $199/year.
This provides more sophisticated protection tailored specifically for WordPress vulnerabilities, including specialized rules for common plugin exploits and WordPress-specific attack patterns.
If you handle credit cards or medical data, enterprise WAF solutions include compliance features for PCI DSS or HIPAA requirements. These cost more but provide the documentation and controls regulators expect.
Unsecured Forms and Data Collection
Contact forms, quote requests, and newsletter signups collect customer information. If these forms lack proper security, attackers can inject malicious code, scrape submitted data, or use your forms to send spam.
Form-by-form audit: Visit every page on your website and document each form you find.
Verify HTTPS is enabled (look for the padlock icon). If missing, most hosting providers include free SSL through Let’s Encrypt. Add Google reCAPTCHA to block automated submissions. For WordPress sites, plugins like Contact Form 7 and Forminator include built-in spam protection. Submit test data through each form to verify where it goes. Forms emailing directly to personal accounts create security and compliance problems.
Open Cloud Storage Buckets
Many businesses use cloud storage services like Amazon S3, Google Cloud Storage, or Azure Blob Storage for backups, document storage, or website assets. Misconfigured buckets can expose sensitive data to anyone who knows or guesses the URL.
According to Cybersecurity Ventures, data breaches from misconfigured cloud storage cost businesses billions annually. Insurance companies specifically ask about cloud storage security because breaches are common and expensive.
The bucket audit: Log into each cloud storage service you use and review bucket permissions systematically:
- Amazon S3: Use S3 Access Analyzer to identify buckets with public access
- Google Cloud Storage: Use Policy Analyzer to review bucket permissions
- Azure Blob Storage: Use Storage Analytics to check access settings
Look specifically for buckets marked “public” or allowing “unauthenticated access.” These settings expose your data to anyone on the internet who discovers the URL.
Locking down storage: Make all buckets private by default. Grant access only through IAM roles or signed URLs that expire after a set time period.
For website assets that legitimately need to be public (images, CSS files, JavaScript), create a separate bucket containing only those specific files.
Enable access logging on all buckets to track who accesses your data and when. Review bucket policies monthly and remove access that’s no longer needed.
Taking Action This Week
Focus on external security with this five-day plan:
Day 1: Audit Email Authentication
Run your domain through MXToolbox to check SPF, DKIM, and DMARC configuration. If missing or incomplete, follow your email provider’s setup instructions. This typically takes 30-60 minutes and immediately improves your security posture for insurance applications.
Day 2: Check for Exposed Services
Search Censys for your business name and IP addresses. If you find your servers listed publicly, close those ports immediately. This is the single most dangerous exposure on most small business networks.
Day 3: Scan Your Website
Run a security scan using Sucuri or a similar tool. Update WordPress core, plugins, and themes. Remove inactive plugins and old user accounts. Install or configure a security plugin with firewall protection.
Day 4: Review Cloud Storage
Check all cloud storage buckets for public access. Make everything private unless there’s a documented business reason for public access. Enable logging and set up access alerts.
Day 5: Test Your Forms
Submit test data through every form on your website. Verify HTTPS is enabled and working properly. Add CAPTCHA to forms that lack spam protection. Confirm form submissions are encrypted in transit and stored securely.
What Comes Next
Your external attack surface represents the frontline of your security posture.
Combined with the internal security improvements from Part 2a, you now have a complete picture of your security posture. Most compliance gaps aren’t complex technical problems. They’re configuration oversights and maintenance gaps that accumulate over time.
Need Help Securing Your Perimeter?
External security requires specialized knowledge of email protocols, web security, and cloud configurations. Many business owners find more problems than they can address alone or discover issues that require expertise they don’t have in-house.
At Beacon Web, we help businesses prepare for cyber insurance applications and strengthen their website and email security posture. Whether you need guidance on email authentication, help securing exposed services, or a comprehensive review of your online presence, we can provide the expertise you need.
We work with businesses to:
- Review and configure email authentication (SPF, DKIM, DMARC)
- Secure WordPress sites and web applications
- Configure web application firewalls
- Document website security controls for insurance underwriting
If you’re preparing for a cyber insurance application or renewal and want expert guidance on securing your external attack surface, we’re here to help.
Contact us to schedule a consultation. We’ll discuss your specific situation, identify priority areas, and help you strengthen your security posture before insurance companies evaluate your external defenses.