Quick ways to determone whether impacted devices may be internet facing

I am fairly new to the field and wonder whether there are rules of thumb or quick ways to determine whether the impacted devices are likely to be internet-facing without doing a Shodan search.

Edit: thanks for the answers so far, should clarify that I am especially interested in indicators in a vulnerable software itself that would immediately associated it with an internet-facing device.

cybersecurity devices doing edit facing far internet may rules search shodan thanks