Jorge wants to assess his organization’s Internet-accessible attack surface. Which of the following methods is most likely to provide a complete understanding?

Penetration tests will typically include vulnerability scanning as well as other activities that can provide a more complete view of an organization’s Internet-facing attack surface. OSINT alone will not provide technical testing. Threat feeds do not provide information about a specific organization’s attack surface, and vulnerability scanning may not reveal other issues like application issues.