A quarterly scan of our own address space, after the first run found two things nobody owned.
2025-10 8 configured, 10 discovered.
2 unaccounted: an internal API with an
expiring certificate, and a staging host
serving real data.
2026-01 9 configured, 9 discovered. clean.
2026-04 9 configured, 10 discovered.
1 unaccounted: a colleague's temporary
tunnel, left running for six days.
the third run is why this is quarterly rather than a
one-off.The first run of a scan like this finds the accumulated backlog and every subsequent run finds whatever appeared since, which is a smaller and more current problem. The tunnel is the ordinary case — nobody did anything wrong and something was listening that nobody had decided should be.