Security playbook · AI Employee: Sig

Public Exposure Monitoring

New public exposure caught within 24 hours

Install this playbookBack to marketplace
The problem

Publicly exposed assets happen accidentally: an S3 bucket someone made public in a workshop, a Kubernetes dashboard exposed via a misconfigured ingress, a database that was supposed to be behind a VPN, a Grafana with default admin credentials. The security team monitors known assets; the exposures happen on the ones they don't know about. Internet-scanner services find them within hours; attackers find them within days.

At a glance
Trigger
Cron (daily)
Approvals
None
What it does
Read-only
Systems
Wiz · Cloud APIs · External scanner
How it feels in production

An hour-by-hour walkthrough.

Every hour, Sig scans the company's external attack surface from an internet perspective: - All known IP ranges from AWS, GCP, Azure account inventories - All owned domains (cert transparency, DNS enumeration) - All CDN-fronted resources For each, Sig identifies: - Exposed services (HTTP, SSH, RDP, databases) - TLS posture (versions, cipher suites, cert validity) - Fingerprint / banner (server type, version, sometimes credentials-in-response) - Sensitive-service exposure (databases, admin panels, dev environments) New exposures compared against baseline. Sig detects: - Bucket that was private yesterday, public today - Port 5432 (PostgreSQL) newly accessible from the internet - Dev-cluster.dev.acme.com resolving publicly with admin dashboard exposed - Grafana instance with default credentials responsive For each new exposure, Sig triages severity, notifies the responsible team (from asset ownership + Context Graph), and drafts the remediation. High-severity (database exposed, admin panel accessible) triggers immediate incident. Weekly digest to CISO: exposure surface trend, top exposures, resolved-in-window rate.
How it works

Step by step.

  1. 01

    Hourly external attack surface scan

    Scan owned IP ranges + domains from an internet perspective. Enumerate exposed services + banners + TLS posture.

    Cloud inventory · DNS enum · Port scanners · Shodan-style tools
  2. 02

    Compare against baseline + detect new exposures

    Diff against prior scan. New exposures highlighted; changes to existing (new TLS weakness, banner change) also captured.

    Baseline store · Diff engine
  3. 03

    Triage severity + identify owner

    Severity model: sensitive service > weak TLS > banner leak. Owner from Context Graph + asset tags.

    Severity model · Context Graph · Asset ownership
  4. 04

    Notify + remediate

    Owner DM with specific exposure + fix. High-severity auto-incident + immediate action. Config-management fix for supported providers.

    Slack · Teams · IaC · Cloud config
  5. 05

    Weekly digest + trend to CISO

    Exposure surface size, new exposures per week, mean time to remediation, top offender teams. Prioritized by potential impact.

    Analytics · CISO digest
Systems and wiring

What you connect to make this run.

AWS · GCP · Azure inventory

read

Owned IP ranges + resources. Complete asset picture drives complete external scan.

Cert transparency · DNS enum · Shodan-style external scanners

read

External-perspective view. Sees what attackers see.

IaC · Cloud config

read+write

Auto-remediation for supported patterns (S3 public → private, Security Group tighten). PR-driven for review.

PagerDuty · Slack · Teams

read+write

High-severity incident promotion + owner notification for lower-severity.

What changes

Before and after, honestly.

Time from new exposure to detection
Before
Days to weeks
After
Under 1 hour
Mean time to remediate high-severity exposures
Before
24-72 hours
After
1-4 hours
Public exposures found by external researchers
Before
5-15 per year
After
0-2 per year
Sensitive-service exposures at any time
Before
3-10 exposed
After
0-1 (with active remediation)
Related

Playbooks that pair with this one.

Security

Cloud IAM Reviews

IAM misconfigurations often cause exposures; joint prevention.

Security

Incident Response Orchestration

High-severity exposures promote to incident response.

Security

Vulnerability Remediation Requests

Exposed services may have vulnerabilities; unified remediation queue.

Frequently asked

Answers about this playbook.

What about intentionally public resources (marketing site, docs)?

Whitelist of intentionally-public resources. Exemptions per resource; scan continues but exemption is respected. Sensitive-service exposure not exemptable.

How does it handle CDN-fronted assets?

CDN passes-through analyzed; origin exposures detected even when fronted. Some CDNs (Cloudflare) hide origin IP; detection uses different signals.

What about internal-network-only resources exposed by accident?

Prime detection target. Internal-only resource suddenly public is the exact scenario this catches. Auto-remediation returns to prior baseline.

How does it handle short-lived environments (preview URLs, PR environments)?

Short-lived environments tagged; scanned but with adjusted thresholds. Auto-shutdown of dev environments with sensitive-service exposure.

Does it interact with our WAF?

WAF logs feed the signal set. Sudden WAF-block spikes may indicate exposure attempts. Joint tuning of exposure detection + WAF rules.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore Security playbooks