110 S&P 500 Companies Have a Database, Remote-Desktop, or Telnet Port Open to the Internet — 105 Have No Bounty Program
We checked live port-scan results across the whole index for the ports that should almost never face the public internet: Redis, MySQL, PostgreSQL, RDP, and Telnet. One in five companies has at least one exposed. The same disclosure-coverage gap our last four reports found holds again — this time on infrastructure that shouldn't be reachable at all.
NullBlocks Research — August 2026
Our last four reports each found the same shape from a different angle: subdomain-takeover risk, GraphQL introspection, Wayback-archived legacy pages, and version-matched critical CVEs all concentrate outside the small cluster of companies that already run a bug-bounty program. This report asks a blunter question than any of those: forget version strings and schema details — is there a database or remote-admin port simply open to the public internet at all.
Methodology, up front
domrecon runs a TCP port scan across every live subdomain it discovers for each company, recording open ports and, where available, a service banner. We flagged five ports that have no legitimate reason to be reachable from the open internet in almost any production architecture: Redis (6379), MySQL (3306), PostgreSQL (5432), RDP (3389), and Telnet (23) — each of these, when open with no additional access control in front of it, is a direct path to data access or remote code execution, not a theoretical risk. We are not attempting authentication or exploitation against any of these — this is a passive port-state observation only, the same free-tier scan any domrecon user gets by entering a domain.
1. 110 of 543 companies (20.3%) have at least one of these ports open
That's one in five S&P 500 companies with a database or remote-admin service directly reachable from the public internet, across 9,348 individual open-port findings on live subdomains:
| Port | Service | Companies affected |
|---|---|---|
| 3389 | RDP (Remote Desktop) | 100 |
| 6379 | Redis | 91 |
| 3306 | MySQL | 90 |
| 5432 | PostgreSQL | 53 |
| 23 | Telnet | 46 |
RDP and Redis are the two most common exposures by a wide margin — RDP because it's frequently opened for a specific remote-support use case and never closed afterward, Redis because it ships with no authentication by default in a lot of deployment paths and is trivially discoverable once open. Telnet's continued presence at 46 companies, in 2026, on the S&P 500, is its own small data point about how far "we'll get to hardening that eventually" debt can travel.
2. It's not concentrated where you'd expect
| Sector | Companies with exposure |
|---|---|
| Financials | 19 |
| Industrials | 16 |
| Information Technology | 12 |
| Consumer Discretionary | 12 |
| Health Care | 10 |
| Utilities | 8 |
| Consumer Staples | 7 |
| Real Estate | 6 |
| Materials | 6 |
Financials has both the highest count in absolute terms and one of the
larger shares of its own sector (19 of 75 tracked Financials companies,
~25%) — the same pattern our first report on this dataset (Attack Surface
of the S&P 500) found in raw exposed-database counts back in July. This
report confirms it's not a one-time artifact: the sector with the most to
lose from a database or admin-port breach still shows the highest
concentration of them sitting open, four independent reports later.
3. The overlap: 105 of 110 companies (95.5%) have zero HackerOne coverage
This is the fifth time we've run this cross-reference against
bounty_coverage, and the fifth time it's landed in the same place. Of the
110 companies with at least one exposed database or remote-admin port,
only 5 have any matched HackerOne bounty program. The other 105 — including
several of the highest-exposure-volume companies in the dataset — have no
HackerOne program at all:
| Company | Sector | Findings | Distinct risky ports | Services exposed | HackerOne coverage |
|---|---|---|---|---|---|
| Workday, Inc. | Information Technology | 1,968 | 5 | mysql, postgres, rdp, redis, telnet | None |
| Arthur J. Gallagher & Co. | Financials | 950 | 5 | mysql, postgres, rdp, redis, telnet | None |
| MGM Resorts | Consumer Discretionary | 800 | 5 | mysql, postgres, rdp, redis, telnet | None |
| American International Group | Financials | 699 | 3 | mysql, rdp, redis | None |
| McKesson Corporation | Health Care | 494 | 3 | mysql, rdp, redis | None |
| Motorola Solutions | Information Technology | 438 | 3 | mysql, rdp, redis | None |
| Dominion Energy | Utilities | 405 | 3 | mysql, rdp, redis | None |
| Johnson Controls | Industrials | 366 | 3 | mysql, rdp, redis | None |
| Southern Company | Utilities | 300 | 3 | mysql, rdp, redis | None |
| CBRE Group | Real Estate | 279 | 3 | mysql, rdp, redis | None |
To be clear about a real limitation here: an open port is not the same as an exploitable vulnerability. Some of these are behind IP allowlists, VPNs, or additional auth layers our passive scan can't see (we do not attempt to connect or authenticate). Raw finding count also reflects how many subdomains share the same exposed backend, not how many independent systems are at risk — a company can show a high count because one shared database cluster fronts many subdomains. This table is a starting point for investigation, not a ranked "worst company" list. What it does establish reliably, a fifth time in five independent exposure classes: real exposure exists broadly, and it does not track with whether a company has a paid disclosure channel.
An honest caveat
This pass only checks HackerOne — Bugcrowd and self-hosted
security.txt-only programs aren't in this cross-reference yet, so treat
"no H1 coverage" as "no H1 program found," not "no path to responsibly
disclose at all." An open port also isn't automatic proof of a viable
attack path — this is a passive TCP-state observation, not an
authentication attempt or exploit. This is a signal for where to look, not
a confirmed finding you can report as-is.
What this means if you hunt bug bounties
- An open database or admin port is a starting point, not a payday by itself. Confirm what's actually behind it (auth requirements, network position, whether it's even the real production instance) before assuming it's reportable anywhere.
- Check security.txt and Bugcrowd before writing a company off — this pass is H1-only, same caveat as our last four reports.
- RDP and Redis are the two most common exposures here — if you're scoping a target in this index, checking for both is now a five-report pattern, not a one-off finding.
- This is now a five-for-five pattern across independent exposure classes (subdomain takeover, GraphQL introspection, Wayback legacy pages, version-matched critical CVEs, and now exposed database/admin ports). If you're deciding where to spend hunting time, "companies outside the ~15-name mature-program cluster" is consistently where the S&P 500's real, unaddressed technical risk sits.
Check your own footprint
Everything above came from the same free tool anyone can run right now: domrecon.com — enter a domain, get a plain-English risk grade, open-port inventory, full technology stack, and live subdomain data, including whether we've matched it to a known bug-bounty program. No signup required.
If you want the aggregate, cross-company view instead of one domain at a time — the kind of query that produced this report — that's what we built next: Graph Explorer, continuous scanning of the S&P 500's public attack surface as one interactive graph. See what's in it →
Data as of 2026-08-21, one point-in-time snapshot from our port-scanning pipeline and nightly HackerOne sync — not continuous monitoring. Spot an error, or want the underlying query for a specific company? Reply — we read every message.
NullBlocks Systems — domrecon attack-surface intelligence.