Network security audits that put exposure in context.

Map reachable services and security boundaries

The assessment starts with network interfaces, internal and external addresses, routing and DNS. The scope includes subnets, reachable hosts, listening ports and internet-facing endpoints, with attention to IPv4 and IPv6. An organisation can close an IPv4 route while unintentionally leaving the equivalent IPv6 service reachable.

Discovery also considers NAT, VPNs, VLANs and security zones. The purpose is to understand which services can reach each other, including east-west traffic between internal systems, and identify shadow devices or unexpected services.

• Firewall configuration and accidental exposure through UPnP or port forwarding.
• Administration panels, remote access, container APIs and orchestration interfaces.
• DNS exposure, dangling records and domain or email controls where applicable.

A reachable port is a finding, not a complete risk assessment

A public service may be intentional. Risk depends on its authentication, software version, privileges and relationship to other systems. A development endpoint on an internet-facing host deserves different treatment from the same service on an isolated test network.

AI Defence’s risk-correlation design combines external and internal attack surface with trust boundaries. For example, an exposed management service becomes more urgent when its account can change production deployments or reach a sensitive database. This is contextual analysis, not an assertion that a particular path has been exploited.

Verify the intended restriction and the surviving access

A recommendation may be to restrict a management interface, remove an unnecessary port or adjust a firewall rule. Any such change requires explicit authority and a plan to preserve legitimate traffic and administrator access. Existing routes and dependencies should be recorded before modification.

Post-change checks need to establish both that the unwanted path is closed and that required application and management paths still work. Continuous monitoring is then designed to identify newly opened ports, unexpected devices, changed routes and weakened firewall configuration.

Connect exposure findings to adaptive trust

The newer Network Trust architecture extends this exposure assessment with device identity, posture and expected network context. Unknown or materially changed devices may receive only the paths needed for enrolment and remediation. Private services require explicit access authority; public websites retain their intended public audience.

The proposed Deception Zone is separate: production access is denied first, then selected traffic may encounter isolated synthetic resources with no path back into production. Both integrated quarantine and deception remain planned, not established network production capabilities.