A Real Incident: Getting Proof That a Port Closure Actually Worked

We run SurfaceDiff on our own domains, the same as any customer would. This is a walkthrough of a real incident it generated - not a dramatic breach story, but a good example of what the tool is actually for: not just noticing a change, but being able to prove one.

The setup

One of our monitored servers had a development service listening on port 3000/tcp. It had been there since our very first scan of that domain - which matters, because SurfaceDiff's first scan of anything is always just a baseline. There's nothing to compare it to yet, so nothing about an existing open port gets flagged on day one. That's correct behavior, not a gap - the interesting question isn't "what's open right now," it's "what changed since last time."

The change

We decided that port didn't need to be reachable from the public internet and closed it off at the firewall. That's a completely ordinary piece of routine hardening - the kind of small cleanup task that's easy to do and just as easy to forget you did, three months later, when someone asks "wait, is that still open?"

What SurfaceDiff did

The next scheduled scan ran, built a new snapshot, and diffed it against the previous one. Port 3000/tcp was gone. That became one incident - type PORT_CLOSED, severity low (closing a port is a lower-risk event than one opening, and the severity reflects that) - with a title, a timestamp, and the specific evidence behind it. A real alert email went out for it, the same as it would for any other new finding.

We reviewed the incident and marked it acknowledged with a one-line reason: "Firewalled." That reason, the timestamp, and who did the reviewing are all kept - permanently attached to that exact incident, not just implied by a dashboard that only shows the current state.

Why this is the actual point

A lot of attack-surface tooling is pitched purely as "we'll catch bad things appearing." That matters, but it's only half of what a real audit trail is for. The other half is proof of the fix: when you tell someone "we closed that port," you can point at a specific incident with a timestamp and a reason, instead of just asserting it from memory. That's the difference between a dashboard that shows you the current state and an audit trail that shows you the history behind it.

Curious what a scan of your own domain would surface? Run a free scan - free, no card required, just a DNS record to prove you own the domain.