The forgotten sites nobody was patching are the easiest for the attackers, AI finding and highlighting vulnerabilities.

01What happens.

Software that is not maintained is software that is not patched. A property that has dropped out of the organisation's records has dropped out of its security programme too, while remaining reachable under the organisation's domain. The security industry documents such subdomains as entry points for phishing and takeover across government and large corporate estates.

02Why it matters.

If you are accountable for security, your programme covers the estate you have a list of, and the list is shorter than the estate. Across risk profiling of more than 119 million websites, 41% were unknown to the organisation's own digital teams. What you cannot list you cannot patch, cannot renew, cannot monitor and cannot take down when it is used against you.

The same map that closes the surface reduces the bill. An organisation that knows its landscape and removes what no longer earns its place spends less on hosting, security and maintenance, answers with one voice, and moves faster than one still carrying the estate it inherited. That is the opportunity the map opens.

03The case.

This is a documented pattern, with the organisations involved drawn from the security industry's published research and from AAAnow's own findings; no client is identified.

A subdomain set up for a campaign 6 years ago points to a hosting service the organisation stopped paying for. The hosting service releases the address, and anyone can claim it. Whoever does now controls a site that carries the organisation's own domain name, and a phishing page on it passes the checks a recipient makes. The organisation's security team has never seen the subdomain, because it was set up by an agency and never handed over.

A microsite for a product line sold 4 years ago runs on a content management system 3 versions behind. The vulnerability in that version is public. The site is not on the patching schedule, because it is not on any schedule, and it is the way in.

A form on a legacy platform still accepts submissions and still emails them to an address nobody reads. A script on an old page still loads a library from a service that has since changed hands. A certificate on a forgotten site expires, browsers warn visitors away, and AI reads the warning as a fact about the organisation.

Each is a property the organisation once built and no longer manages or controls. Together they are an attack surface with the organisation's name on it, outside its monitoring, and an attacker looks there first because the defences are thinnest.

The organisations that have closed this surface did it the same way: they mapped the estate from the outside, as an attacker and an AI both read it, decided what to keep, and removed the rest. The removed properties stopped costing to host, and the surface they had presented was gone with them.

04Exposure.

The exposure sits in 2 places. The first is the incident: a takeover, a phishing campaign under the organisation's name, or an intrusion through an unpatched site, each attributable to a property the organisation did not know it had. The second is the account the organisation has to provide afterwards, when the question is why a property carrying its name was outside its security programme.

Insurers price the second as well as the first. An organisation that can evidence it knows its landscape, has removed what no longer serves and monitors what remains carries that evidence into renewal and into any discussion of risk quality, coverage and terms. No outcome is automatic.

05What AI Readiness changes.

What the organisation cannot see from the inside is the estate beyond its own list, because the list is where the inside view ends. AAAnow reads the digital landscape from the outside, as an attacker and an AI both read it, and evidences what is online under the organisation's name, including the properties absent from its records. With the landscape known, the organisation decides what to retain, remediate or retire, and route removal, the disciplined retirement of what no longer earns its place, follows the landscape stage.

Your team makes the changes; AAAnow provides the assessment, the evidence, the guidance and the review.

06Related use cases.

07References.

• 41% of websites unknown to the organisation's own digital teams: AAAnow / Sitemorse risk profiling, 2017 to 2023, covering more than 119 million websites.
• Forgotten subdomains as attack entry points: ZeroFox, 2025. www.zerofox.com/blog/forgotten-subdomains-easy-targetszerofox.comWe do not enable external links - please copy and paste, you are then certain as to the link being opened
• The Triad of Exposure, AAAnow external report v4.