External access audit: what a hacker sees
Updated on 2 November 2026.
The curse of the Internet
The Internet was designed so that any machine can reach any other. That is what makes it so convenient: checking your cameras from your smartphone, letting the refrigeration engineer monitor the cold room, working from home on the office server. It is also its curse: what you can reach from anywhere, anyone can try to reach.
There is no shortage of examples:
- October 2026, supermarket fridges: in France, hackers took control of the refrigeration controllers of hundreds of stores and started the defrost cycle. We covered it in detail in our article on connected devices.
- A casino and its aquarium: in 2018, Nicole Eagan, CEO of the security firm Darktrace, described how hackers got into a casino's network through the connected thermometer of the lobby aquarium, then left with the high-roller database.
- Target and its subcontractor: at the end of 2013, the hackers who stole the data of 40 million payment cards from the US retailer Target got in with the credentials of a heating and refrigeration subcontractor, which had network access for billing and project management.
A thermometer, a fridge, a supplier's account: the door is almost never the one being watched.
The doors hackers try first
In an SME, the same doors open to the Internet come up almost every time. Here are the most targeted, from the most common to the most unexpected.
- Windows Remote Desktop (RDP). It is the simplest way to work remotely on a PC or server, and the hackers' favourite. In the incidents handled by the security vendor Sophos in 2023, remote access services were the way in in 65% of cases, and remote desktop was used by the attackers, to get in or to move around the network, in 90% of attacks. In one case, the same company was hacked four times in six months through its open remote desktop.
- The VPN and the firewall. They are there to protect you, but they are devices like any other, with their own flaws. According to Verizon's 2025 report, among intrusions that went through a software flaw, 22% targeted these "edge" devices, compared with 3% a year earlier. And over the year, only about half (54%) of the flaws in these devices had been fully fixed, with a median delay of 32 days. In 2025, the Akira ransomware group targeted SonicWall VPNs: it used passwords stolen in earlier intrusions, often left unchanged after an old firewall was replaced, and usually went from login to encrypting data in under four hours, sometimes in 55 minutes.
- Remote support software (TeamViewer, AnyDesk, ScreenConnect and others). Your IT provider or the vendor of your business software uses it to help you. But software installed once for a support call, with a password never changed, or a former provider who kept their access, are so many keys left lying around. In 2025 Microsoft described intrusions that began by exploiting flaws in this kind of tool.
- The NAS (file server). Very handy for reaching your documents from outside, it is also a well-known target: in January 2022, the DeadBolt ransomware encrypted more than 3,600 QNAP NAS devices reachable from the Internet. The manufacturer advised taking them off the Internet and disabling port forwarding and UPnP on the router.
- The website and its software. On 21 October 2026, two critical flaws in the PHP language (nicknamed PHP2Shell), which runs a large share of websites, led many organisations to take their sites offline while waiting for the fix, in Belgium as well as in the Netherlands and France. A few days later, the US agency CISA added them to its list of actively exploited vulnerabilities.
- Connected devices: cameras, alarm, access control, heating, cold room, charging stations, solar panel inverter. Often installed by a third party, rarely updated.
In Belgium, the pace is picking up
Between 1 January and 28 September 2026, the CCB received 588 incident reports, already more than the 556 for the whole of 2025. Compromised systems became the most reported type of incident, with three times as many reports as in the previous quarter. Among the basic measures it asks companies to apply without delay: multi-factor authentication for administrator accounts and remote access, fixing actively exploited vulnerabilities first, and keeping the systems reachable from the Internet to the strict minimum. The CCB also asks business leaders to appoint someone responsible for these measures.
In other words: knowing what your business shows the Internet is no longer a matter for specialists, it is a management decision.
What is an external access audit?
It means looking at your business from the outside, through a hacker's eyes, and answering three questions for each door found:
- What is visible from the Internet? Addresses, devices, services, software and their versions.
- Is it necessary? Many doors were opened "just for a day" and never closed again.
- Is what must stay open protected? Up to date, with a password unique to the device and two-factor authentication, reachable only by those who need it.
It is not a penetration test: the aim is not to break in but to take stock and fix. It is quicker, cheaper, and it removes most of the risk.
What you can check yourself
Allow one hour, with no particular technical skills.
1. List who comes in from outside
Take a sheet of paper and note, for each person or company that connects to your systems from outside: who, to what, with which tool, and when they last did.
| Who | Questions to ask |
|---|---|
| You and your staff working from home | By what means? Remote desktop, VPN, remote support software? Two-factor authentication enabled? |
| Your IT provider | Which tool? One account per person? Are you notified of each connection? |
| Business software vendors (accounting, till, management) | Is their access permanent or opened on request? |
| Installers (alarm, cameras, heating, refrigeration, solar) | Can the device be reached directly from the Internet? Has the default password been changed? |
| Former providers and former employees | Have their accounts and access software been removed? |
A line nobody can answer is a door to examine first.
2. Sign up for Safeonweb@work
The CCB's service for Belgian businesses is completely free. Once registered, you receive alerts about vulnerabilities and infections detected on your network. The CCB also offers a "Quick Scan" report giving an overview of security flaws and possible improvements for what you have online, as well as a self-assessment and the CyberFundamentals framework.
3. Look up your address on Shodan
The Shodan search engine lists devices visible on the Internet and what they expose. By searching for your connection's IP address, you see what a stranger sees. How to do it is explained in our article on connected devices.
4. Test the most common doors of your connection
The free ShieldsUP! service (grc.com website) tests from the Internet the most common ports of the connection you run it from. Run it from the office network, not from home. A port reported as "open" deserves a question to your IT provider. A clean result guarantees nothing: the test covers neither all doors nor your other connections.
5. Clean up the accounts
Delete the accounts of former employees and providers, uninstall remote support software nobody uses any more, and enable two-factor authentication wherever possible, starting with remote access and administrator accounts.
Where doing it yourself stops
Your check covers most of the known doors. It has limits that hackers do not:
- Forgotten doors: a second Internet line, the address of a warehouse or shop, an IPv6 address, an online service rented years ago.
- The full test: checking all 65,535 possible ports of each address, identifying each piece of software and its version, then comparing them with known and actively exploited flaws.
- Configuration: a firewall can be up to date and badly set up (rules too broad, administration open to the Internet, forgotten local accounts).
- The past: in the SonicWall case, the passwords had been stolen months before the attack. Reading the VPN and firewall login logs can reveal an intrusion already under way.
- Fixing without breaking things: closing a door the till, the accounting or remote work depends on means planning another solution, often a VPN with two-factor authentication.
Fixes, in order of priority
| Fix | Effort | Cost |
|---|---|---|
| Close remote desktop (RDP) open to the Internet: go through a VPN with two-factor authentication | Low to medium | Often none |
| Update the firewall, VPN and NAS; change passwords if the device ran a vulnerable version | Low | None |
| Remove unused accounts and access software (former employees, former providers) | Low | None |
| Two-factor authentication on all remote access and administrator accounts | Low | None to low |
| Disable UPnP and unnecessary port forwarding on the router | Low | None |
| Take off the Internet devices that have no business there (NAS, cameras, controllers); access via VPN or the manufacturer's portal | Medium | Low |
| Replace devices the manufacturer no longer updates | Medium | Hardware purchase |
| Redo the inventory every quarter and after each change (new provider, new device, move) | Low | A few hours a year |
To replace an open remote desktop with a VPN, you need a router that handles it. Two examples, from the simplest to the most complete:
In practice: three options
| Option | What it costs | The risk |
|---|---|---|
| Do nothing | Nothing, as long as nothing happens | One forgotten door is enough: ransomware, stolen data, business at a standstill for days |
| Check it yourself | An hour or two, with the list above, Safeonweb@work and Shodan | Missing a door, or not knowing how to fix it without disrupting the business |
| Have an external audit carried out | A few hours of audit, then the fixes | The lowest: complete inventory of your addresses, known flaws checked, logs reviewed, prioritised remediation plan |
Example (illustrative case): an eight-person accounting firm. The inventory reveals four doors: the server's remote desktop, open to the Internet since lockdown "for remote work"; a TeamViewer installed by a former IT provider and still active; the NAS, reachable from outside through port forwarding; a firewall that has not been updated for two years. Fixes: remote work through a VPN with two-factor authentication, remote desktop closed on the Internet side, TeamViewer uninstalled, NAS reachable only through the VPN, firewall updated and all its passwords changed. Cost: half a day's work, no purchase.
For your IT person
- Inventory all public addresses: secondary lines, remote sites, IPv6, DNS records (forgotten subdomains), cloud services and hosting.
- External scan from a third-party connection, only on addresses you are mandated for:
nmap -p- -sVover TCP, plus common UDP ports (500/4500 IPsec, 1194 OpenVPN, 51820 WireGuard, 161 SNMP). - Shodan
net:<range>and Censys for history; Shodan Monitor for an alert on each newly exposed service. - Compare exposed versions with the CISA KEV catalogue and CCB warnings (e.g. 28/10/2026: Cisco Secure Firewall ASA/FTD).
- RDP: never exposed; RD Gateway or VPN with MFA. Also check port forwarding and UPnP on the router.
- Firewall and VPN: management interface closed on the WAN side, unused local accounts removed. SonicWall: after running a version vulnerable to CVE-2024-40766, reset all stored secrets (SSL VPN passwords, OTP seeds, synchronised LDAP accounts) and check the SSLVPN default user group.
- Remote support tools: inventory on all machines, allowlisting (App Control / AppLocker), one named account per technician with MFA.
- Logs: VPN logins from hosting providers (VPS) rather than ISPs, out-of-hours logins, unexpected accounts.
- PHP: versions fixed for PHP2Shell (CVE-2026-109618, CVE-2026-109619): 8.5.12, 8.4.27, 8.3.36 and 8.2.35; older versions receive no fix.
Test yourself
Sources
Arctic Wolf. (2025). September 2025 update on aggressive ongoing Akira ransomware campaign. https://arcticwolf.com/resources/blog/september-2025-update-ongoing-akira-ransomware-campaign/
Centre for Cybersecurity Belgium. (2023, November 14). Safeonweb devient grande sœur ! news.belgium.be. https://news.belgium.be/fr/node/35190
Centre for Cybersecurity Belgium. (2026, October 15). Figures show a steady rise in incidents: the CCB urges enterprises to act immediately. https://ccb.belgium.be/news/figures-show-steady-rise-incidents-ccb-urges-enterprises-act-immediately
Cimpanu, C. (2022, January 28). Deadbolt ransomware hits more than 3,600 QNAP NAS devices. The Record. https://therecord.media/deadbolt-ransomware-hits-more-than-3600-qnap-nas-devices/
Jonkers, J. (2026, October 16). CCB sounds the alarm: cyber incidents at Belgian companies already exceed 2025 totals. ITdaily. https://itdaily.com/blogs/security/ccb-more-cyber-incidents-in-belgium/
Krebs, B. (2014, February 5). Target hackers broke in via HVAC company. Krebs on Security. https://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/
Microsoft Security Experts. (2025). Keys to the kingdom: RMM exploits enabling human-operated intrusions in 2024–25. Microsoft Community Hub. https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/keys-to-the-kingdom-rmm-exploits-enabling-human-operated/ba-p/4410903
Paganini, P. (2018, April 16). Attackers exfiltrated a casino's high-roller list through a connected fish tank. Security Affairs. https://securityaffairs.com/71433/hacking/fish-tank-hack.html
RTBF. (2026, October 21). Une faille informatique mondiale met de nombreux sites internet en état d'alerte. https://www.rtbf.be/article/une-faille-informatique-mondiale-met-de-nombreux-sites-internet-en-etat-d-alerte-11803667
Sophos. (2024). Cybercriminals abuse Remote Desktop Protocol (RDP) in 90% of attacks handled by Sophos incident response in 2023, Sophos' newest Active Adversary report finds. https://www.sophos.com/en-us/press/press-releases/2024/04/cybercriminals-abuse-remote-desktop-protocol-rdp-90-attacks-handled
Verizon. (2025). 2025 Data Breach Investigations Report. https://www.verizon.com/business/resources/reports/dbir/
watchTowr. (2026, October 26). CVE-2026-109618: Exploited remote code execution in PHP. https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
Zorz, Z. (2025, September 29). Akira ransomware: From SonicWall VPN login to encryption in under four hours. Help Net Security. https://www.helpnetsecurity.com/2025/09/29/akira-ransomware-sonicwall-vpn/