One of the best-known examples is Shodan, a search engine for internet-connected devices and services. Unlike Google, which indexes web pages, Shodan scans the internet for exposed services such as remote access tools, routers, firewalls, webcams, databases, and cloud-hosted systems.

That matters because attackers use similar visibility to find targets. They do not need to know your company name, your supplier, or your IT provider. They can search by service, port, software product, location, or cloud provider and quickly build a list of systems to investigate further.

Why MongoDB Is a Useful Example

For this example, we searched Shodan Maps for MongoDB services in Great Britain:

MongoDB is a popular database platform used by developers, SaaS products, internal tools, and web applications. Unlike a normal public website, a database would not usually need to be directly reachable from the open internet. In most well-designed environments, the database sits behind an application layer, private network, VPN, firewall rule, or managed access control.

What This Does and Does Not Prove

The important point is balance. A Shodan result does not automatically mean a database is leaking data. It does not prove that authentication is missing, that customer records are exposed, or that a business has been breached.

What it does show is that the service is discoverable from the public internet. That visibility is enough for attackers to start asking the next questions: is it patched, is it authenticated, is it misconfigured, is it a forgotten development system, and does it expose version information that matches a known vulnerability?

In other words, the map is not evidence of compromise. It is evidence of attack surface.

Why Internet-Facing Databases Are Risky

Databases are high-value systems because they often contain customer records, credentials, order histories, financial information, logs, internal business data, or application secrets. If a database is exposed unnecessarily, a single configuration mistake can become a serious incident.

Common causes include rushed cloud deployments, temporary developer environments, old test servers, weak firewall rules, misconfigured security groups, default settings, or systems that were meant to be private but became public during a migration.

For small and medium-sized businesses, the risk is often not sophisticated hacking. It is ordinary infrastructure drift: something was opened for convenience, nobody reviewed it later, and eventually it became part of the permanent attack surface.

What Businesses Should Do

The answer is not to hide from Shodan. If Shodan can find a service, other scanners can find it too. The answer is to reduce what the public internet can see in the first place.

The Lesson for UK SMEs

This kind of search is a useful reminder that internet exposure is not theoretical. Public services can be discovered, mapped, and filtered at scale. Attackers do not need insider knowledge to start looking for weak points.

For SMEs, the practical question is simple: do you know what your business exposes to the internet right now?

If the answer is no, it is worth finding out before someone else does. External network testing, cloud configuration reviews, and attack surface checks can identify visible systems, unnecessary services, and risky exposures before they turn into incidents.

Neil Campbell is owner and operator at SME Cyber Solutions Ltd and a member of the Crimes Against Biz Policy Group for the FSB. He writes about AI, automation and practical technology infrastructure for UK SMEs.