Remote attack surface discovery and management

One or more non-transitory machine-readable media having program code stored thereon, the program code comprising instructions to:

• identify first and second endpoint devices associated with an organization that are connected to respective first and second networks external to the organization based on obtained data for the first and second endpoint devices based, at least in part, on a determination that a respective first and second public network addresses corresponding to the first and second networks are not associated with the organization, wherein the first and second networks are different;
• examine first data about the first network to determine whether the first network complies with a security policy of the organization;
• examine second data about the second network to determine whether the second network complies with the security policy of the organization, wherein the first data and the second data were obtained based on ongoing probing of public network addresses;
• based on a determination that the first network does not comply with the security policy, indicate the first endpoint device and noncompliance with the security policy of the first network to which the first endpoint device is connected;
• and
• based on a determination that the second network does not comply with the security policy, indicate the second endpoint device and noncompliance with the security policy of the second network to which the second endpoint device is connected.

An apparatus comprising:

• a processor;
• and
• a non-transitory computer-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
• based on analysis of first endpoint data obtained from a plurality of endpoint devices associated with an organization,
• identify a first endpoint device of the plurality of endpoint devices that has established a first network connection to a first network that is external to a network of the organization based, at least in part, on a determination that a first public Internet Protocol (IP) address corresponding to the first network is not associated with the organization;
• and
• identify a second endpoint device of the plurality of endpoint devices that has established a second network connection to a second network that is not associated with the organization, wherein the second network is different from the first network;
• correlate a first subset of the first endpoint data corresponding to the first endpoint device with first data obtained from probing the first public IP address associated with the first network;
• correlate a second subset of the first endpoint data corresponding to the second endpoint device with second data obtained from probing a second public IP address associated with the second network;
• determine, based on the first and second data, if at least one of the first and second networks is associated with a security risk;
• and
• based on a determination that at least one of the first and second networks is associated with a security risk, indicate that at least one of the first and second network connections established by the at least one of the first and second endpoint devices exposes the network of the organization to the security risk.