Exposed services
Which services should my firm never leave open to the internet?
Remote access, file sharing and the login pages of VPN and firewall devices are where attackers start.
Last read from the sources at the foot of this page.
01
Which services and devices are on this list?
One page for each. Every page cites the government advisory or the maker's own notice it rests on.
- Remote Desktop open to the internet
- SMB file sharing open to the internet
- Telnet open to the internet
- VNC open to the internet
- FTP server open to the internet
- SSH open to the internet
- Database open to the internet
- Docker API open to the internet
- Cisco ASA and Firepower VPN login
- SonicWall SSL VPN
- Fortinet FortiGate SSL VPN
- Ivanti Connect Secure VPN
- Palo Alto GlobalProtect VPN
- Citrix NetScaler Gateway
- On-premises SharePoint on the internet
- On-premises Exchange and Outlook on the web
- Office NAS reachable from the internet
- Remote support tools on the internet
- Admin login pages on the internet
Sources
Where does this come from?
- CISA: Known Exploited Vulnerabilities Catalogcisa.govRead 14 October 2026
- Canadian Centre for Cyber Security: Alerts and advisoriescyber.gc.caRead 14 October 2026
03 · Check my firm
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Received
A person reads your firm from outside and emails your outside reading within 72 hours, from [email protected].
What happens next
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
While you wait: the 72 hours · 34 seconds, no sound
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/