In cybersecurity, one question frequently arises: what can an attacker actually see before even attempting an intrusion?

The answer is sometimes surprising. Without possessing any privileged access, a cybercriminal can already collect a significant amount of information about an organization simply by observing what is exposed on the Internet. Forgotten servers, expired certificates, unmanaged subdomains, misconfigured services, or insufficient email protections: all of these represent potential points of entry.

It is specifically to help businesses measure this exposure that ITrust developed Security Rating, an External Attack Surface Management (EASM) solution.

A threat level that remains persistently high

While the threat landscape is evolving, its intensity shows no sign of waning.

According to the latest report published by ANSSI, the number of handled cybersecurity incidents remains at a particularly high level. While the overall volume of events slightly decreased compared to the previous year, this decline is mainly explained by the exceptional context of the Paris Olympic Games. Conversely, the number of confirmed incidents remains stable, confirming that French organizations continue to be heavily exposed to cyberattacks.

In this context, strengthening one's cybersecurity no longer consists solely of protecting the information system: it has become essential to understand what is visible from the outside.

Viewing your organization through an attacker's eyes

The initial stages of a cyberattack are rarely technical. They almost always begin with a reconnaissance phase.

Attackers map Internet-facing assets, identify exposed services, search for known vulnerabilities or configuration errors, and then select the easiest targets to exploit.

This is precisely the visibility that Security Rating provides.

Starting from a company's domain name, the solution analyzes publicly accessible assets and evaluates their level of exposure, without ever penetrating the information systems. The objective is therefore not to conduct an internal audit, but to obtain an accurate snapshot of what a malicious actor is capable of observing from the Internet.

This approach notably allows the identification of:

  • forgotten or insufficiently secured servers;
  • exposed subdomains;
  • expired or misconfigured TLS certificates;
  • accessible services presenting known vulnerabilities;
  • weaknesses in email domain security;
  • configuration errors that could expand the attack surface.

All of which are elements that sometimes go unnoticed internally, yet remain fully visible to a cybercriminal.

Assess your security level with Security Rating

Receive a free, non-binding extract from the Ikare reputation scan report: reputation score, status of your external posture, and an overview of prioritized actions (30 days)

A snapshot of the cyber posture of companies in Occitanie

In partnership with La Dépêche du Midi, ITrust carried out an analysis of the external exposure of major private companies across the thirteen departments of the Occitanie region.

In total, 63 companies from various sectors were evaluated using Security Rating.

Each organization receives a grade ranging between A and F, accompanied by a score out of 100, reflecting the quality of its security posture as visible from the Internet.

The results are overall encouraging:

  • 61% of companies obtained an A grade;
  • 24% obtained a B;
  • 13% were graded C;
  • only one company received a D;
  • none were graded E or F.

Furthermore, eight companies achieved the maximum score of 100/100, indicating excellent management of their external exposure.

It is, however, important to reiterate that a strong score does not imply an organization is invulnerable. Conversely, a lower grade does not indicate that it will inevitably fall victim to a cyberattack. The Security Rating primarily measures the level of exposure observable from the Internet and highlights priority areas for improvement.

Key areas of vigilance

The analysis highlights a strong trend: the observed weaknesses generally do not stem from critical or zero-day vulnerabilities.

They primarily involve:

  • configuration of TLS certificates and encryption mechanisms;
  • protection of email domains;
  • control of the Internet exposure surface;
  • management of public digital assets.

In other words, the room for improvement often lies in cyber hygiene and digital asset governance.

These elements may seem trivial, but they often represent the initial clues exploited during reconnaissance phases conducted by threat actors.

Visibility: the first step towards an effective cybersecurity strategy

You can only protect what you know.

Yet, over the years, organizations accumulate applications, cloud services, domain names, development environments, and connected infrastructures. This expansion automatically broadens their attack surface.

Maintaining continuous visibility over this exposure is therefore an essential lever for mitigating risk, prioritizing remediation actions, and sustainably strengthening one's security posture.

With Security Rating, ITrust supports enterprises in this process by delivering an objective, continuous, and clear assessment of their external exposure, enabling them to quickly identify areas for improvement and act before an attacker exploits them.

Because in cybersecurity, the best defense often starts with a simple question: what do others see of your enterprise?