Assets you do not manage or are not aware of, remotely accessible servers with misconfigured and insecure authentication mechanisms and services
Weak and misconfigured encryption protocols and ciphers, login issues, manin-the-middle attacks, exposed data
Insecure code and vulnerable software components that enable attackers to take full control of assets, default credentials, and misconfigurations
E-mail and phishing waterhole operations, domain takeovers, DNS hijacking, third-party hosting, acquired businesses and subsidiaries, certificates with broken or unreliable trust chains