During the scramble to set up remote working, an IT contractor opened a port so a director could reach the office desktop from home, tested that it worked, and moved on to the next urgent request on a long list. Nobody wrote it down. Nobody scheduled a review. Years later, that same port sits open on the same server, still reachable from anywhere on earth, and the director in question stopped working from that desktop a long time ago.

The remote access left running long after it was needed

Remote desktop protocol and similar remote-access services exist for good reason, letting staff and IT teams reach systems from outside the office. Left exposed directly to the internet without proper controls, though, they become one of the most reliable entry points criminals use to get inside a business. There is no phishing email required, no employee needs to click anything. The service is simply sitting there, listening for connections, and a stolen or guessed password is often all that stands between the internet and full access to that machine.

Every internet-facing service a business runs, whether it is remote desktop, a VPN gateway, or an old admin panel nobody remembers configuring, adds to what security professionals call the external attack surface. Thorough external network pen testing maps every single one of these entry points from an outsider’s perspective, exactly as a criminal scanning the internet would see them, and flags which ones should never have been left reachable at all.

Criminals scan for this constantly, without ever targeting you specifically

The unsettling part of this risk is how impersonal it is. Automated tools scan the entire internet address range continuously, cataloguing every exposed remote-access service they find within hours of it appearing. Nobody needs to specifically target your business for this to become a problem. You simply need to be one of the millions of addresses scanned that week, with a service listening that should have been closed off, restricted to a VPN, or protected with proper multi-factor authentication long before the scan ever reached you.

William Fieldhouse regularly finds exactly this kind of long-forgotten exposure during external assessments.

“We found remote desktop wide open on a server that the client insisted had been decommissioned two years earlier, and when we dug into it, the machine was still processing payroll every single month without anyone realising it was visible from the open internet.”

— William Fieldhouse, Director of Aardwolf Security Ltd

The client’s own confidence was the most telling part of that discovery. They were certain the machine was gone, because on paper it had been replaced, yet it kept running quietly in the background, doing genuinely important work while remaining completely undocumented in anyone’s asset list. A business cannot properly secure what it has forgotten it still owns, and forgotten systems have a habit of being exactly the ones still processing something nobody can afford to lose.

Knowing exactly what your business exposes to the internet

Every business has some version of this exposure sitting on its perimeter, a service opened for a specific purpose, never closed once that purpose passed, and never reviewed since. Regular best pen testing company is the only reliable way to see your business the way an opportunistic attacker does, from the outside, scanning for exactly this kind of oversight. If nobody can currently list every service your business exposes to the internet, that is the conversation worth having next.