Skip to main content

Understanding your attack surface

The Attack Surface view in Tresal gives you a live overview of all external components tied to your monitored assets. This article walks you through how to read and use the Attack Surface section effectively.

Matthias Peeters avatar
Written by Matthias Peeters
Updated over 2 months ago

🧠 What is an attack surface?

Your external attack surface is everything an attacker could potentially see or access from the internet — like:

• Public hostnames

• IP addresses

• Open ports and services

• Exposed technologies

• Known vulnerabilities

Tresal maps and monitors this surface continuously.


📍 Where to find it

In the sidebar, go to Attack Surface.

You’ll see a high-level summary at the top with:

• Number of hostnames discovered

• Number of ports, protocols, services, and technologies

• Risk breakdown: Critical, High, Medium, Low

📅 This section auto-updates after each scan — check the timestamp at the top for last updated time.


🔍 Filtering the surface

Use the filter bar to search by:

• Hostname or domain

• IP address

• Specific services or technologies

• Risk level

You can also group the list view using the “Group by” dropdown (e.g., by risk level or asset).


📋 Asset-level visibility

Each row in the table shows:

• The type (e.g., Hostname)

• The value (e.g., app.deltaworx.eu)

• Detected ports, services, and technologies

• Current risk level

• When the asset was last seen

Clicking on a row gives you more technical details and helps you pivot into the Findings section for actionable steps.


✅ Why this matters

Your attack surface constantly changes — from DNS updates to new subdomains or exposed services. Tresal helps you:

• Stay aware of what’s public

• Quickly detect weak points

• Understand the structure of your internet-facing infrastructure

Did this answer your question?