Most organisation think about security in terms of what they know about. Known systems. Known vulnerabilities. Known risks. The problem is that attackers do not start from your asset inventory. They start from the internet and work inward, and they find things your inventory does not include.
The Verizon 2026 Data Breach Investigations Report found that vulnerability exploitation surpassed stolen credentials as the leading initial access vector for the first time in the report's 19-year history, accounting for 31% of breaches. IBM X-Force confirmed a 44% year-over-year increase in attacks beginning with exploitation of public-facing applications. What both findings share is that the targets being exploited were findable. The attackers found them first.
Here is exactly how that discovery process works.
Step 1: They Use Tools Built for This
Shodan, Censys, and GrayhatWarfare are not hacking tools. They are search engines that index internet-facing infrastructure continuously. Shodan alone indexes cloud instances, exposed admin panels, open storage buckets, and servers running known vulnerable software versions. Any asset your organisation has exposed to the internet is almost certainly already indexed.
Attackers search for your organisation's IP ranges, domains, and cloud provider fingerprints and retrieve a real-time picture of what is exposed. The process takes minutes. The average enterprise runs over 3,000 misconfigured cloud assets at any given time, according to CybelAngel's 2026 research. Cloud misconfigurations accounted for 23% of all cloud security incidents in 2025. One forgotten S3 bucket or unretired test environment is enough. The tool finds it. The attacker did not have to look specifically for your organisation to find it.
Step 2: They Watch Certificate Transparency Logs
Every TLS certificate issued for a subdomain is publicly recorded in Certificate Transparency logs. These logs are open to anyone and updated continuously. They reveal your infrastructure as it grows, including staging environments, internal tools, and development subdomains that were never intended to be reachable from outside your network.
Automated tools monitor CT logs in near real time. When a new subdomain appears, attackers can scan it within minutes, before your security team has had a chance to apply the same hardening controls used for production systems. A dev environment built on an older framework version becomes an entry point not because it was targeted deliberately, but because it was found and it was soft. According to reconn.io's 2026 external attack surface research, 25% of assets discovered by EASM tools are previously unknown to the organisations that own them. Unknown to the organisation. Already indexed by the attacker.
Step 3: They Search Your Code Repositories
GitHub and GitLab are searched continuously by automated tools looking for exposed API keys, cloud provider tokens, and configuration files containing live connection strings to production systems. Developers pushing code that accidentally includes a live credential create an exposure that automated scrapers identify within minutes of the commit.
This is one of the most consistent entry points for SaaS products running fast release cycles, as covered in the guide to penetration testing for SaaS startups. Google Cloud's Threat Horizons Report H1 2026 identified credential harvesting from third-party SaaS tokens as a primary method driving large-scale, silent data exfiltration. Identity compromise underpinned 83% of compromises studied. This is not a rare or sophisticated attack. It is an automated search running against public repositories every hour of every day, looking for strings that match the pattern of a live key.
Step 4: They Harvest SaaS Session Tokens
Modern SaaS environments create an attack surface that sits entirely outside your network perimeter and outside the reach of most traditional security controls. Google Cloud's H1 2026 report noted that threat actors have shifted from traditional phishing to voice-based social engineering and SaaS token theft, bypassing MFA entirely without needing to touch the network layer.
Once a SaaS token is compromised, attackers gain persistent, silent access to the application, its integrations, and often its downstream cloud resources. The access does not look like an intrusion because it uses legitimate session credentials. Service accounts in large organisations outnumber human users by 5:1, and nearly 40% of organisations fail to enforce MFA across all cloud users, according to DataStackHub's 2026 cloud vulnerability analysis. Expired tokens from former employees and contractors represent access that has never been formally closed. This pattern appears consistently across ANZ testing engagements and is covered in depth in our guide on 5 underdiscussed SaaS attack patterns across NZ and AU.
Your Last Pentest Is Already Out of Date
Every week you ship without continuous testing is a week a vulnerability goes unseen. See what Capture The Bug finds in your first engagement.
Step 5: Automated Scanners Move Faster Than Human Response
The speed at which attackers operate after a CVE is published has changed fundamentally in 2026. The median time from vulnerability disclosure to active exploitation in cloud environments dropped to 72 hours, according to DataStackHub's 2026 analysis. That is not 72 hours to attempt an attack. That is 72 hours to identify, confirm, and begin exploiting vulnerable systems at scale.
IBM X-Force found that AI tools now enable attackers to scan the internet for systems matching a vulnerable configuration, correlate those systems with known exploit chains, and begin automated exploitation attempts within hours of a CVE becoming public. This is matched on the defensive side through AI-powered security testing, but the attacker tooling currently runs faster than most patch and response cycles.
The discovery phase takes hours. The scanning is automated and continuous. By the time a vulnerability is confirmed exploited in the wild and added to the CISA KEV catalog, the scanning of the broader internet for that flaw has already been completed. The assets that were findable were found. Over 54% of critical vulnerabilities face active exploitation within the first week of disclosure, according to Indusface's 2026 vulnerability statistics research. The targeting is not selective. It is systematic.
What Comes After Discovery
This article covers the reconnaissance phase: how attackers find and index assets before any exploitation begins. What happens next, specifically why so many of those discovered assets remain vulnerable long enough to be exploited, is a separate structural problem covered in detail in why known vulnerabilities still get exploited.
The specific vulnerabilities being actively targeted right now are documented in the top exploited vulnerabilities in 2026.
The question this article raises is a narrow one: can attackers see your assets? If you have cloud infrastructure, SaaS integrations, active subdomains, or developer repositories, the answer is almost certainly yes. The more useful question is whether your security programme sees the same things they do, at the same speed. Continuous penetration testing for SOC 2 and ISO 27001 compliance is built around exactly that model: running the same reconnaissance against your own environment on an ongoing basis, so the findings reach your team before they reach an attacker.
Book a free security consultation with Capture The Bug to map your external attack surface and find what is visible before an attacker does at our Request Demo page.
Plan Your Annual Pentesting Strategy the Right Way
Learn how modern SaaS companies structure pentesting across the year to reduce risk, stay compliant, and avoid last-minute panic before audits.
FAQ
How do attackers find unpatched assets in cloud environments?
Attackers use passive scanning tools like Shodan and Censys, certificate transparency log monitoring, public repository searches for exposed credentials, and SaaS token harvesting. None of these require direct access to the target environment. All run continuously, making any internet-exposed asset visible within hours of creation.
How quickly do attackers find and begin exploiting vulnerabilities after public disclosure?
The median time from CVE disclosure to active exploitation in cloud environments has dropped to 72 hours, according to DataStackHub's 2026 cloud vulnerability analysis. IBM X-Force found AI-powered scanning now enables attackers to identify vulnerable systems and begin exploitation within hours of a CVE becoming public. Over 54% of critical vulnerabilities face active exploitation within the first week of disclosure.
What is shadow IT and why does it create a reconnaissance risk?
Shadow IT refers to cloud resources, SaaS tools, or subdomains created by teams without central IT or security knowledge. Because these assets are not in the official inventory, they are never hardened, never monitored, and often left with default or missing access controls. Attackers discover them through the same automated scanning and CT log monitoring used to map all internet-facing infrastructure, and they find them before the owning organisation does.
What tools do attackers use to discover cloud assets?
Attackers use Shodan and Censys to index internet-facing services and devices, GrayhatWarfare and S3Scanner to locate exposed cloud storage buckets, certificate transparency log monitors to track newly created subdomains, and automated GitHub and GitLab scraping tools to search for exposed API keys and cloud credentials. All of these are publicly available and operate continuously without human involvement.
How does continuous penetration testing replicate attacker reconnaissance?
Continuous penetration testing runs the same passive and active discovery techniques that attackers use, including external asset scanning, subdomain enumeration, CT log analysis, and credential exposure checks, against the organisation's own environment on an ongoing basis. The goal is to find newly created or changed assets before an attacker does, rather than testing a fixed snapshot of known systems on a once-a-year cycle.
