> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/prevention-tools/external-scan.md). # External Scan The External Scan identifies vulnerabilities in your information system through an automated, weekly analysis of its external surface. It is non-intrusive and only looks at the infrastructure that is accessible to everyone.

:gear:

Configuration

Add your domain names and public IP addresses.Configuration

:chart-line:

Reading results

Understand your score and each detected vulnerability.Reading results

:network-wired:

IP addresses and traffic

Recognize the scanner's traffic and allowlist it.IP addresses and traffic

:ban:

Excluding false positive assets

Remove an asset that is not part of your infrastructure.Excluding false positive assets

:bug-slash:

Excluding false positive vulnerabilities

Dispute a vulnerability that is wrong or not yours.Excluding false positive vulnerabilities

:circle-question:

Common questions

Penetration test, missed vulnerabilities, remote desktop and MFA.Common questions
## Attacks exploiting vulnerabilities In this type of cyberattack, a hacker takes advantage of a vulnerability in your computer system to gain access to it or act within it. These vulnerabilities can be: * Outdated software that has not been updated. * Poorly configured services. * Open ports accessible from the Internet. * Systems not protected by security mechanisms. Cybercriminals use automated tools or targeted techniques to detect these flaws, then exploit them to take control of the system, steal data, deploy malware (for example ransomware) or disrupt your business. Four basic recommendations to protect yourself: 1. Address vulnerabilities detected by the External Scan. 2. Regularly update all systems and software. 3. Limit services exposed to the Internet. 4. Apply security best practices from the initial configuration. ## What the scan checks You can access the External Scan from the `External Scan` tab in your Stoïk Protect account. It automatically and continuously inspects your resources accessible from the Internet. In particular, it identifies: * Ports accessible from the outside (potential entry points for an attacker). * Exposed services and technologies. * Known vulnerabilities (CVEs) that can be exploited if patches are not applied. It also examines other external information, such as Internet reputation or the presence of data leaks related to the main domain name. It detects vulnerabilities by connecting to the CVE database and runs port scans to check whether certain ports are open. A detected vulnerability is displayed on the "Infrastructure" tab of your Stoïk Protect platform. ## Methodology and impact on your infrastructure The scan runs continuously, discreetly and non-intrusively. It generates a very low volume of requests, which limits the risk of detection or blocking by your security tools, and it identifies known vulnerabilities without affecting the operation of your systems. In more technical terms, it uses your domain name to estimate your attack surface: domains, subdomains, associated IP addresses and the various services. These are all the paths through which a malicious hacker might attempt to gain entry. The scan is built on an aggregation of open-source tools, mainly Shodan, Nucleus, Censys and Sublist3r. It makes a significant number of queries from an AWS IP range located in Ireland, once a week, during the night from Friday to Saturday. {% hint style="info" %} Some Stoïk insurees are regularly scanned by organisations not affiliated with Stoïk. If a scan affects the availability of your IT system, contact CERT Stoïk, our incident response team, on the emergency number indicated on your insurance policy or at . The CERT team is available 24/7. Stoïk also recommends using a web application firewall (WAF) or a solution such as Cloudflare to mitigate distributed denial-of-service (DDoS) attacks. {% endhint %} ## Customers and prospects The scan runs even before you subscribe to Stoïk insurance, to determine your eligibility. It does not run the same way for a prospect and for a customer: a prospect needs a fast eligibility decision, while a customer needs comprehensive coverage of vulnerabilities. The "Prospect" scenario therefore removes several resource-intensive steps: * The "Bruteforce" task is not enabled: data leaks are not tested. * The "Technology Discovery" task is not enabled: the technologies used by all customers are no longer checked, to improve scan speed. The minimum throughput is also increased: more queries are performed per second. Prospect analyses are faster and less thorough than those of customers, which are longer but more comprehensive. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stoik.io/prevention-tools/external-scan.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.