Reconnaissance: The Phase Attackers Never Skip
Before any exploit is launched, attackers spend significant time learning about their target. Understanding this phase is essential for building better defences.
Every engagement — whether a penetration test or a real attack — begins with the same phase: reconnaissance. It is the most time-intensive part of an attack and the one defenders pay the least attention to.
What Attackers Are Looking For
Reconnaissance is about attack surface mapping. An attacker wants to answer:
All of this information is available without touching the target's network. It is gathered through open source intelligence (OSINT) — search engines, LinkedIn, GitHub, Shodan, certificate transparency logs, and more.
The Passive vs Active Distinction
Passive reconnaissance leaves no trace. Searching for your organisation's name on GitHub, or using Shodan to map internet-facing services, generates no alerts and no logs on your side.
Active reconnaissance — port scanning, probing web applications — does leave traces, but many organisations lack the detection capability to notice.
The implication: by the time you see suspicious activity, the attacker may have been watching you for weeks.
What You Can Do About It
You cannot prevent passive reconnaissance entirely, but you can make it less useful:
Reduce your external footprint. Every exposed service that does not need to be public is unnecessary attack surface. Audit what is internet-facing and close what should not be.
Monitor for credential exposure. Services that alert on leaked credentials in breach databases and paste sites give you early warning of a specific and serious risk.
Treat your LinkedIn as attack surface. Org charts, technology mentions in employee profiles, and job postings all reveal information attackers use. This does not mean hiding your people — it means being aware of what you are advertising.
Know what an attacker sees. Run periodic external attack surface assessments. If you have never looked at your organisation from the outside, you do not know what you are defending.
The Defender's Mindset Shift
Most security teams think about defence from the inside out: protect our systems from attack. The reconnaissance phase teaches a different perspective: understand what the attacker sees before they attack.
This mindset shift — from inside-out to outside-in — is fundamental to proactive security. You cannot defend what you do not know you are exposing.
Why Most Breaches Are Not Sophisticated
The myth of the elite hacker obscures a more uncomfortable truth: organisations are compromised daily through basic oversights, not zero-days.
Phishing Still Works Because We Let It
Despite decades of awareness campaigns, phishing remains the leading initial access vector. The problem is not the technology — it is the training.
Building Security Culture in Small Organisations
Large enterprises have dedicated security teams. Small organisations have to build culture instead. Here is how to make security everyone's responsibility without burning out your team.