Attack Surface of the S&P 500

We scanned all 520 constituents. Here's what the internet actually knows about corporate America's biggest companies.

NullBlocks Research — July 2026

FedEx has 8,504 public subdomains. The company one spot down the complexity ladder, Accenture, has 5,303. The median S&P 500 company has a fraction of either. If you had to guess which sector has the worst exposed-database problem in the index, you'd probably say something in tech. You'd be wrong — it's Financials.

We ran domrecon's automated external-recon pipeline against all 520 companies currently tracked in our S&P 500 dataset: 241,652 subdomains, 168,854 port scans, 112,836 technology fingerprints, 2.05M CVE-family matches, 57,653 TLS/host records. This is what came back.

Methodology, up front

domrecon performs passive and lightweight-active external reconnaissance — subdomain enumeration (crt.sh + threat intel feeds), port/service probing, TLS certificate inspection, HTTP technology fingerprinting, and CVE-family correlation against detected technologies. Everything below reflects the most recent per-subdomain scan as of 2026-07-29 — a point-in-time snapshot, not continuous monitoring. 18 of 520 companies currently lack a GICS sector classification in our table.

One caveat we want stated plainly, not buried in a footnote: all 2.05M CVE matches in this snapshot are unversioned confidence — matched by technology family (e.g. "runs jQuery"), not by a confirmed version string. Treat CVE-match volume here as theoretical exposure by technology family, not a list of confirmed exploitable vulnerabilities. We'd rather a researcher catch us saying this upfront than catch us not saying it at all.

1. Attack surface size varies 8,000x across the index

Average external attack surface across the S&P 500: 468.3 subdomains per company. Range: 1 to 8,504.

Logistics and legacy-industrial giants dominate the top of the list — which tracks. Attack-surface size is a decent proxy for organizational complexity: decades of M&A, subdomain sprawl, shadow IT. Brand/subsidiary count backs this up from a different angle — Ford alone carries 240 tracked brands, Palo Alto Networks 201, Gartner 170. A company's DNS footprint is often a faster read on its complexity and legacy-IT burden than its public financials.

2. Databases, directly reachable from the internet

Plus legacy plaintext protocols still alive at scale: FTP (4,546), Telnet (393), POP3/IMAP (2,525 each), RDP reachable from the internet (2,157).

None of this should exist on a Fortune 500 network regardless of intent. Some of it is probably intentional and access-controlled. A meaningful chunk of it almost certainly isn't. We're reporting aggregate counts and sector-level breakdowns here, not naming individual companies for this finding — the point is the scale of the pattern, not a public callout.

3. Financials has the worst risky-service exposure of any sector

Combining the genuinely risky categories (RDP, Redis, MySQL, PostgreSQL, FTP, Telnet) by GICS sector:

This cuts directly against the "regulated industries have the cleanest perimeters" assumption. Financials — arguably the most compliance-audited sector in the index — leads every other GICS sector in raw risky-exposure count. Whatever's driving that (M&A-inherited infrastructure, third-party vendor sprawl, scale itself) it's not something SOC 2 checkboxes are catching.

4. Certificate hygiene: a two-minute, verifiable check

Of 50,156 hosts with TLS certificate data:

• 1,947 certificates are already expired
• 4,888 are expiring within 30 days
• Combined: 6,835 hosts (≈13.6%) have a certificate problem right now

This is one of the cleanest stats in the whole dataset — a cert is either valid or it isn't, no interpretation required. If you want to spot-check our data quality on a company you already track, this is the cheapest number to verify yourself.

5. Legacy code doesn't die, it just stops being watched

1,277 S&P 500 web properties are still firing Universal Analytics — sunset and stopped processing by Google in 2024. It's a strange thing to still see at scale two years later, and a useful low-cost proxy for how infrequently large public companies touch their own public-facing front-end code. Only 260 DMARC aggregate-reporting addresses were found against 505 tracked company domains — a meaningful minority of large enterprises still lack a baseline email-authentication control.

On the technology-fingerprinting side: jQuery (8,894 detections) is nearly as prevalent as the leading CDN. PHP and jQuery alone account for over 1M of the 2.05M total CVE-family matches — again, unversioned confidence, a maintenance- debt signal rather than a confirmed vulnerability count.

How this compares to Shodan, Censys, and SecurityTrails

We didn't have API access to Shodan, Censys, or SecurityTrails for this report and didn't want to fabricate metrics for competitors we can't verify — the table below reflects each platform's publicly documented capabilities, not a live technical benchmark.

Shodan tells you what's open on a host. Censys and SecurityTrails tell you what's out there. None of them run a fixed-universe, cross-company benchmark — they're built for single-target or ad-hoc-query lookups. domrecon's differentiated angle is running the same pipeline against a fixed, comparable set — all 520 S&P 500 constituents — and aggregating at the company and sector level. That's a different product shape, not a claim that we out-scan any of the three on a single-target lookup.

Actionable takeaways

1. Legacy plaintext protocols aren't dead: FTP, Telnet, and POP3/IMAP remain exposed across S&P 500 external infrastructure at real scale. These are cheap fixes relative to the risk.
2. Verify your own exposed-database posture. 2,147 Redis / 2,134 MySQL / 479 PostgreSQL instances is not a number any Fortune 500 network should be comfortable seeing echoed back at index-wide scale.
3. If you're in Financials: this is a useful external data point for benchmarking your own posture against sector peers, independent of internal audit results.
4. Run the certificate check today. ~13.6% expired-or-expiring is a two- minute, zero-ambiguity fix queue.
5. Treat legacy web-stack prevalence (PHP, jQuery, WordPress) as a maintenance-debt signal, not a confirmed vulnerability count, until version-pinned matching is available.
6. Attack-surface size (subdomain count) is a fast, free complexity signal — worth checking before you assume a target's perimeter is small just because the company is.

Check your own footprint

Everything above came from the same free tool anyone can run right now: domrecon.com — enter a domain, get a plain-English risk grade, version-matched CVEs, full technology stack, and live subdomain inventory. No signup required.

If you want the aggregate, cross-company view instead of one domain at a time, that's what we built next: Graph Explorer — continuous scanning of the S&P 500's public attack surface, one interactive graph, updated as it changes. See what's in it →

Full chart set: charts/ in the NullBlocks research repo. Data quality notes and full methodology in the companion research brief. Spot an error or want the underlying query for a specific company? Reply — we read every message.

NullBlocks Systems — domrecon attack-surface intelligence. nullblocks.com · domrecon.com