Attack Surface Management Explained
Every device, app, and login point a company exposes is a potential door for criminals. Attack surface management is about mapping all those doors before anyone else does.
Key points
- Attack surface management (ASM) is the practice of finding and securing every digital entry point a company exposes to the outside world.
- The number of entry points most organisations own has grown sharply as staff work remotely, use cloud services, and connect more devices.
- Criminals routinely scan the internet for forgotten or unpatched systems, often finding them before the company's own IT team does.
- SecurityWeek held a virtual summit on the strategies and tools organisations need to get ahead of this problem.
What exactly is an "attack surface"?
For a company, the attack surface is every website, login page, employee laptop and cloud storage account it operates. Criminals probe all of them, looking for one that is unlocked.
The problem has grown because most organisations have added doors faster than they can count them. Remote working and bring-your-own-device policies have expanded the perimeter a security team must defend, and cloud software has made that perimeter harder to see in the first place.
How do criminals exploit a large attack surface?
Automated scanning tools let criminals check millions of internet addresses in hours, hunting for devices running outdated software or login pages with weak passwords. When they find one, they move fast.
Ransomware gangs, the criminal groups that lock a company's files and demand payment to restore them, almost always enter through exactly this kind of overlooked exposure. Initial access brokers, a criminal sub-industry that breaks into organisations and sells that access to ransomware operators, have made a business out of scanning for forgotten systems. Our 3 September report on BraZetsu showed how far that sub-industry has industrialised: the framework packages infected Windows machines as ready-to-sell inventory on criminal marketplaces.
One unpatched server sitting on the edge of a network can be enough. Microsoft's September patch release, the largest on record, fixed 974 flaws, two of them already used in active attacks.
What does attack surface management actually do?
ASM continuously discovers and scores every digital asset a company exposes. The goal is to find the unlocked doors before criminals do, then either close them or watch them closely.
Tools in this space scan a company's own infrastructure the way a criminal would, surfacing forgotten subdomains or services switched on for a project and never switched off. Prioritisation matters: not every finding is equally dangerous, and security teams are always short on time. Our 28 August story on continuous exposure management covers why organisations are replacing periodic scans with something that never stops.
What should ordinary employees watch for?
Keep work software updated. Old versions are one of the most common footholds. Follow your employer's guidance on approved apps and devices: personal tools added without IT approval become invisible doors that nobody is watching.
Report anything odd. A login prompt that looks slightly different, a request for your password by email, a device behaving strangely. These small signals are often the first sign that someone is probing the perimeter.
Here's the honest verdict: ASM tools are genuinely useful, but they only work if someone acts on the findings. Plenty of organisations buy the dashboard and let the alerts pile up. The technology isn't the hard part.
