Exposed surface signals: a reason to call

A rep with a book of SME accounts has no particular reason to phone any one of them this morning, and that's the actual gap. Without a reason the call turns into a friendly check-in about the renewal date, and security never makes it into the conversation at all.

An SME's exposed surface closes that gap, as long as you read it for what it is. It isn't an audit. It's the list of things anyone on the internet can already see about that company without asking permission: an address that answers, a certificate, a domain sending mail, an employee's address sitting in a public dump. The whole advantage is that you read it first.

What the internet already sees

An open port is just a service that answers when something knocks. Port 445 is SMB, Windows file and printer sharing, built for the office network rather than for the open internet; when you find it exposed there's rarely a decision behind it, only a firewall rule written years ago by someone who has since left. Port 3389 is Remote Desktop, opened "for a couple of weeks" during an office move or a stretch of working from home, then never closed again. Both get hammered by the automated scanners that crawl the internet around the clock, and nobody needs to have it in for your customer: the bots work through addresses in order.

Then there's software that answers and announces its own version. A web server, a CMS, an admin panel a few years behind: the vulnerabilities in those versions are published, documented and available to anyone who can read. The customer hasn't noticed, because the site works. Working and being current aren't the same thing, and that's a sentence a rep can say without knowing any security at all.

TLS certificates tell the same story more loudly. Expired, issued for a different name, or signed by nobody but itself, and the browser throws the red warning that stops a visitor cold. If that happens on the portal where the customer's own clients upload documents, the damage is commercial before it's technical.

Email says more than people expect

SPF declares which servers may send on behalf of a domain. DKIM signs outgoing messages so the recipient can check nothing was altered in transit. DMARC is the rule that tells the recipient what to do with a message that fails those checks, and sends back reports on whoever tried. Without them, writing to that SME's suppliers while pretending to be that SME costs a fraudster five minutes: same domain in the From line, an invoice attached, different bank details. And the detail worth a phone call turns up constantly: DMARC published, but set to the monitoring-only policy that asks for reports and blocks nothing. On paper it's there. In practice it isn't.

Credentials that already left the building

A public credential dump is the result of a theft that happened somewhere else: a shop, a booking site, a forum where the purchasing manager signed up with a work address. The breached site isn't your customer's problem. The reused password on their mail or their VPN is, because it was the convenient one. When an employee's address shows up in a dump like that, you're holding a fact no generic slide can compete with.

And there's the part no scan will ever see: whether backups actually get restored or only taken, and who still holds admin credentials months after walking out the door. That's what questionnaires are for, and a questionnaire nobody ever filled in is a signal in itself, because it means nobody has put those questions to that customer yet.

A signal is not a report

This is the distinction that decides everything. A report lists findings, sorts them by severity and lands on the customer's desk, from where it goes to their IT guy and comes back to you whenever he gets round to it, if it comes back. A signal is one thing only: a fact, a date, and the consequence of that fact in business language. The report follows later, carrying your logo, once the conversation is already open.

Suppose your rep opens the brief on Monday morning. They're not reading vulnerabilities, they're reading reasons to call:

• port 3389 reachable from outside, seen on 2 September: that customer's remote desktop is open to the world and probably nobody in the building remembers leaving it that way
• no DMARC on the main domain, checked on 4 September: anyone can write to their clients using their name
• two staff addresses in a credential dump published in August
• a security questionnaire sent in June and still unopened, while their largest client has just started circulating a supplier questionnaire of its own

Each of those lines starts a call with "I'm ringing about something specific" rather than "just seeing how things are going".

The date does half the work

A date turns an opinion into something checkable. It changes the question the customer asks, from "says who?" to "since when?". It protects you as well, because you're not claiming the company is insecure forever, you're saying what was true on 2 September; if they've closed the port since, good, and the call still did its job.

Dates matter afterwards too. A posture with no date ages quietly and walks you into a meeting holding a six-month-old picture. Stamped, it marks itself stale the moment the account changes, and the lead generation co-worker refreshes it without anyone having to remember to.

Where this usually breaks

Signals on their own won't close anything, and anyone who has carried a bag knows why. The rep opens well, the customer says "our IT guy handles that" or "we need that port open", and out comes the line that kills the deal: "let me get one of our engineers to call you back." There's one engineer, the queue is long, and the proposal goes out a fortnight later with the urgency gone.

So signals and answers have to travel together. The lead generation co-worker says who to call and why; the sales co-worker prepares the four-phase brief (Prepare, Discovery, Objections, Close) with the objections that customer will raise, answers built on that customer's own data, and a close on a service from your catalogue, at your price, under your brand. Where there's no data, it says so instead of filling the gap, which is the only reason a rep can read those lines out loud with a straight face.

An open port sells nothing by itself. An open port, with the date you saw it and the right sentence to follow it, is why that customer picks up the phone.