Attack Surface Management

Port Exposure

Surface exposed ports across your Azure network security groups, prioritize closures by risk, and reduce your attack surface.

START FOR FREEREQUEST DEMO

TENET Exposed Ports view listing internet-facing network security group rules by risk, direction and destination port

Open Ports

ResourcePortSourceRisk

vm-web-prod-013389 · RDP0.0.0.0/0Critical

vm-backend-0222 · SSH0.0.0.0/0Critical

storage-files-01445 · SMB0.0.0.0/0High

vm-backend-038080 · HTTP10.0.0.0/8Medium

func-api-prod443 · HTTPS0.0.0.0/0Low

Port Management

Expose risky entry points

Surface exposed ports across your Azure network security groups. Prioritize closures by risk and shrink your attack surface before attackers' probes find them.

Priority

Risk-Ranked Closures

Rules open to any source, 0.0.0.0/0 or *, are the highest priority to review, so the most exposed ports come first.

Open ports · ranked

vm-web-prod-01

3389 · RDP · source 0.0.0.0/0

Highest

storage-files-01

445 · SMB · source 10.0.0.0/8

Lower

NSG rule

NSG

nsg-web-prod

Resource group

rg-web-prod

Rule

allow-rdp-internet · priority 300

Source

0.0.0.0/0

Destination

Any

Network context

Network Context

Each exposure shows its NSG, resource group, rule name and priority, and its source and destination ranges. Open the rule in the Azure Portal from there.

Remediation Tracker

Turn findings into action

Move from insight to closure faster with clear, prioritized fixes. Convert every security gap into a tracked, assigned task with priority, owner, and due date, giving your team a clear path from discovery to resolution.

Remediation

vm-compute-eastus-4: block inbound RDP from 0.0.0.0/0In Progress

Entry node in 3-hop path · T1190 · Score 91

Attack PathPriority: CriticalOwner: a.patelDue: Today

bg-task-runner-0041: revoke Directory.ReadWrite.AllOpen

Admin-consented · unrecognized publisher · permission never observed in use

M365 AppPriority: CriticalOwner: j.mooreDue: Apr 23

svc-identity-prod: reduce Owner assignments to 3 subscriptionsOpen

Pivot node · managed identity used in active attack path · T1078

Attack PathPriority: HighOwner: s.chenDue: Apr 25

storage-files-01: restrict SMB port 445 to corp IP rangeResolved

Open to 0.0.0.0/0 · reachable from attack path target subnet