INDUSTRIES
The technique is the same. The weight of each asset changes.
Finding a forgotten subdomain works the same way in any sector. What changes is what that subdomain is worth: a subscriber portal taken down costs reputation, an exposed academic portal costs a minor's data, a checkout carrying a third-party script costs PCI DSS. Prioritization carries that context.
REGULATED SECTORS
Where a regulator is watching the exposure
Financial services →
Banks, fintechs and payment institutions, with the evidence Central Bank regulation asks for.
Healthcare →
Insurers, hospitals and laboratories, where exposed data is sensitive data by definition.
Government and public sector →
Citizen portals, digital services and agency assets that rarely show up in the official inventory.
Energy and utilities →
Agentless discovery and monitoring, without touching the industrial environment.
Telecommunications →
Edge equipment, subscriber portals and the surface that grows with every acquisition.
OTHER SECTORS
Where the surface grows faster than the inventory
Retail and e-commerce →
Checkout, third-party scripts and the collection of brands every campaign leaves online.
Manufacturing →
The convergence between IT and the industrial environment, seen from the outside.
Education →
Academic portals, learning environments and the assets each department puts online on its own.
WHAT DOES NOT CHANGE
The official inventory undercounts in every one of them
A company's asset list is usually built from the inside out, following the org chart. The attacker builds theirs from the outside in. The gap between the two lists is the surface nobody is watching, and that is what CSURFACE measures first.
Get a preliminary assessment