Research

First-party data from SurfaceLoop's external scanning: anonymised aggregate benchmarks of what organisations actually expose to the internet, published with the data and the method.

September 2026

UK SME External Exposure Snapshot

1,083 UK SME assets scanned: 95% of domains had at least one open finding, 74% were spoofable by email, and every exposed SSH service carried the Terrapin flaw. Data downloadable as JSON/CSV.

Reference

Methodology

How SurfaceLoop scans -- seven external-only risk categories, change tracking, false-positive handling -- and the anonymisation rules every research release follows.