Subdomain enumeration is the process of finding all the subdomains (like mail.example.com or dev.example.com) under a domain. Forgotten or development subdomains frequently expose services and information the owner never meant to publish.
Analysts use certificate-transparency logs, DNS techniques, and dedicated tools to build the fullest possible map of an organisation's attack surface.