Exposed surface reduction

Work only against assets belonging to [authorized organisation or account], within the scope you have been given in writing. If you are unsure whether an asset is in scope, list it as unverified and do not probe it. Enumerate what is reachable from the internet: DNS records and their resolution, hosts and open ports, TLS endpoints and their certificates, cloud storage with public access, and management or admin interfaces that answer from outside. For each exposure, establish two facts before touching anything: who owns it, and what current business reason justifies it being reachable. Anything with no owner or no current reason is a candidate for removal, not a finding to file. Order candidates by what an attacker gains — administrative access first, then authenticated data access, then information disclosure, then everything else. Take the top candidate and make the smallest change that removes the exposure: retire the record, close the port, scope the policy, put it behind the existing access control. After each change, re-run the enumeration and confirm the exposure is gone and nothing that should still answer has stopped answering. Restore immediately if a legitimate service broke. Stop and ask before removing anything with a live owner, anything serving production traffic, and anything you cannot positively identify. Guessing is how outages happen. Finish when every reachable asset has an owner and a current reason, or has been removed. Report the surface you found, what came off it, what remains and why, and anything you could not attribute to an owner.