When HOPLONai External Exposure Monitor reports a finding, fix critical vulnerabilities and exposed ports first, then expired certificates and lookalike domains, then hardening gaps such as a missing WAF.
HOPLONai gives growing businesses a complete security operation: the tools, and the agentic AI team that operates them.
This playbook sets out what to do for each type of finding on your websites, portals and APIs.
What triggers an External Exposure Monitor finding?
Trigger: a finding from HOPLONai External Exposure Monitor.
Input: website vulnerability scan results and threat intelligence data.
How severe is the vulnerability, and what should you do?
Severity | Examples | Actions |
|---|---|---|
Critical or High | SQL injection, remote code execution (RCE), authentication bypass, zero-day exploits. | Notify the security team to patch immediately. Give developers a report with remediation steps. Re-scan after patching to confirm the fix. |
Medium or Low | Outdated libraries, missing security headers, weak TLS configuration. | Ask the development team to schedule a fix. Watch for the severity rising. Apply hardening best practice. |
What should you do about open ports?
Critical ports exposed to the internet (SSH, RDP, database ports): notify IT, restrict access immediately with firewall rules or a VPN, close ports you do not need, apply least privilege and check logs for unauthorised access attempts.
Non-essential ports open (misconfigured services): notify IT and close the ports you do not need.
What if an SSL certificate is expiring or has expired?
Expiring within 30 days: send a renewal reminder, check auto-renewal is on and escalate to the security team if renewal is at risk.
Already expired: notify the security team urgently and renew the certificate now.
What should you do about a lookalike domain?
Block the domain at your email gateway and DNS to stop phishing.
Ask the security team to consider a takedown request.
Check whether any users have exchanged email with the domain.
Train staff to spot typosquatting.
What if no WAF is detected?
Put a web application firewall (WAF) in front of the site to filter malicious traffic before it reaches your application.
Frequently asked questions
What is a lookalike domain?
A lookalike domain is registered to imitate yours, for example by swapping or adding a letter (typosquatting). Attackers use it to send convincing phishing emails or host fake login pages.
What does External Exposure Monitor need to start scanning?
A list of your websites, portals and APIs. See what you need before onboarding External Exposure Monitor.
Is External Exposure Monitor free?
Yes. External Exposure Monitor is part of HOPLONai Freemium, free forever. See the External Exposure Monitor module guide.
HOPLONai is agentic MDR — the security tools a growing business needs, and the AI team that runs them.
Scan your external attack surface for free: start with HOPLONai Freemium, or book a platform tour at hoplonai.com.