# What Are Exposed Services? > Learn what internet-exposed services are, when exposure is expected, and how to prioritize review. Canonical: https://sentryxmonitor.com/learn/external-attack-surface-management/what-are-exposed-services/ Last updated: 2026-08-08 External attack surface management An exposed service is a network service reachable from the public internet on an IP address and port, such as HTTPS on 443, SSH on 22, SMTP on 25, or a database protocol on its assigned port. Reviewed 2026-08-08 Read-only educational guidance ## Key points - Exposure is not automatically a vulnerability. - Unexpected protocols deserve ownership review. - Service monitoring should match business purpose. ## What is what are exposed services? An exposed service is a network service reachable from the public internet on an IP address and port, such as HTTPS on 443, SSH on 22, SMTP on 25, or a database protocol on its assigned port. ## How does it work? A public IP accepts traffic on a port and the service responds according to a protocol. Firewalls, load balancers, reverse proxies, and cloud security groups determine reachability. ## What can go wrong? Administrative and data services may be brute-forced, fingerprinted, or attacked if unnecessarily public. Even expected services can become risky through weak authentication, outdated software, or missing rate limits. ## How can teams detect the problem? Observe reachable ports from authorized external locations, identify the protocol conservatively, and compare results with an approved exposure list. ## How can teams improve the situation? Close unnecessary ports, restrict administrative access, place applications behind appropriate gateways, enforce strong authentication, patch services, and monitor expected reachability. ## What does a technical example look like? ``` 443/tcp HTTPS expected 22/tcp SSH unexpected from internet 5432/tcp PostgreSQL critical review 53/udp DNS expected only for authoritative server ``` The example uses reserved documentation domains and addresses. Apply the same reasoning to systems you own or are authorized to assess. ## Authoritative technical references - [RFC 9162: Certificate Transparency Version 2.0](https://www.rfc-editor.org/rfc/rfc9162.html) ## How does continuous monitoring help? A point-in-time check explains the observed state now. [Continuous monitoring](https://sentryxmonitor.com/services/uptime-monitoring/) establishes an expected baseline, repeats the relevant check, and records meaningful state changes so an owner can investigate before a small configuration drift becomes a prolonged security or availability problem. See [External Attack Surface Management](https://sentryxmonitor.com/learn/external-attack-surface-management/) for the surrounding technical context. ## Where does Sentryx Monitor fit? Sentryx Monitor provides [read-only outside-in discovery](https://sentryxmonitor.com/services/external-attack-surface-monitoring/) and monitoring for public hosts, DNS, HTTPS, TLS certificates, baseline security headers, email-security records, and selected network services. It supports evidence and operational follow-up, but it does not replace authorized penetration testing, authenticated vulnerability assessment, or owner validation. ## Continue learning - [External Attack Surface Management: A Practical Guide](https://sentryxmonitor.com/learn/external-attack-surface-management/) - Learn what EASM is, how external assets are discovered, how exposure changes, and how continuous monitoring supports an accurate internet-facing inventory. - [What Is External Attack Surface Management?](https://sentryxmonitor.com/learn/external-attack-surface-management/what-is-easm/) - A clear explanation of EASM, its workflow, scope, and relationship to continuous security monitoring. - [What Is an External Attack Surface?](https://sentryxmonitor.com/learn/external-attack-surface-management/what-is-an-external-attack-surface/) - Understand which public assets make up an external attack surface and why the inventory changes over time. - [How Attackers Discover Internet-Facing Assets](https://sentryxmonitor.com/learn/external-attack-surface-management/how-attackers-discover-internet-facing-assets/) - Learn the public signals attackers use to find domains, subdomains, IP addresses, certificates, and exposed services. ## Related - [Home](https://sentryxmonitor.com/)