Your database shouldn't be on the internet
An exposed database doesn't get hacked — it gets found. Scanners index every open MongoDB (27017), Redis (6379) and Elasticsearch on the internet, and bots dump, wipe or ransom whatever answers. Roughly 39,000 Redis services are reachable with no authentication at all. Cloaking removes the one thing that makes a database a target: reachability. Cloak it and only your app servers and admins can connect — a scanner sees nothing.
Frequently asked questions
Should a database ever be exposed to the public internet?
Almost never. A database is reached by your application and administrators, not the public. If your MongoDB, Redis, Postgres or Elasticsearch answers the open internet, that's a misconfiguration to fix. Cloaking enforces that boundary so only enrolled identities can connect.
Does Veil add a password to my database?
No — it removes the reason a missing password is catastrophic. With Veil the database is unreachable to anyone but the app servers and admins you enrolled, so an unauthenticated instance can't be found or dumped by a scanner. You should still set a password: defense in depth.
What about a managed cloud database?
Managed databases live inside the provider's network and shouldn't be public either. Veil is for the self-hosted databases you run yourself — Postgres, MySQL, MongoDB, Redis, Elasticsearch — that too often end up bound to 0.0.0.0 and exposed.
Sources: Censys — Databases Exposed (Redis) · CyberLeveling — EU internet exposure research