Target Attack-Surface Snapshot (Passive)
Build an outside-in view of an acquisition target from public sources only — certificate transparency, public DNS and email records, internet search-engine records, breach disclosures and public code — and turn each finding into a diligence question. Passive only: no scanning or testing of the target’s systems without its written authorisation.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice. Subscribers customise it with their own details and generate the document for their own work.
What this template gives you
- Before signing you usually have no permission to test a target’s systems — but a great deal is already public, and it tells you which diligence questions to ask.
- The authorisation boundary comes first: passive, public sources only. No port or vulnerability scans, no login attempts, never trying leaked credentials, unless the target gives written authorisation defining scope.
- 22 checks, each with the passive method: certificate transparency, DNS and email security, search-engine service records, TLS, breach and leak history, public code, typosquats, cloud and vendor footprint.
- A findings table records the public source and date for each finding and turns high and medium findings into questions for management.
Frequently asked questions
Can I scan an acquisition target before the deal?
Not without the target’s written authorisation defining scope, timing and rules of engagement. Unauthorised scanning or testing can be illegal and can breach the NDA or process letter. A passive snapshot from public sources — certificate transparency, public DNS, data that internet search engines have already published, breach disclosures — needs no interaction with the target’s systems. Confirm your approach with counsel.
What should I do with leaked credentials I find?
Record the source, date and count, and raise it as a diligence question. Never try a leaked credential against the target’s systems — that is unauthorised access, whatever the deal stage.
How reliable is a passive attack-surface snapshot?
It is good for direction, not proof. Public records go stale, version banners can be wrong and hosts change owners. Treat each finding as a question for management or a data-room request, not as a confirmed vulnerability.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. Customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.