Blog

Field notes on exposure.

Research and plain explainers on attack surface management, from the team that looks at what answers on the internet all day.

Research

The edge held. The backend didn't.

Two anonymised cases from my research: a large online game provider knocked offline through its exposed backend, and a remote code execution (RCE) that quietly changed balances across sites. The edge held; the backend didn't.

Bob ThillFounder, xSpctr1 November 20264 min read

Read the post

Research · 31 Oct 2026

Exposure is an invitation

Most incidents don't start with a brilliant exploit. They start with reachability, and the people looking already know where to look. On how infrastructure is discovered, a naming pattern that exposed a whole fleet, and why hidden is not the same as restricted.Read the post Explainer · 25 Oct 2026

What is xSpctr? Attack surface management, explained

We show you what an attacker sees first, everything exposed under your names, and what to fix before they reach it. A plain tour of the platform.Read the post

Also in Resources

Guides and the terms.

Guides

Short guides

Attack surface management, email authentication and NIS2.See the guides Glossary

The terms, without jargon

ASM, CVE, KEV, DMARC and the rest, one sentence each.Open the glossary

Find out what you expose. Start with one domain.

Tell us about your organisation and we will set you up.

Get access

Take the tour