Infoblox Wants to Find Your Exposed Assets Before Hackers Do
The network security company is entering a crowded market with a twist: using its deep knowledge of the internet's address book to spot weaknesses rivals might miss.
Key points
- Infoblox announced entry into the External Attack Surface Management market on Tuesday, adding a new Supply Chain Intelligence feature alongside it.
- An early access program across roughly 40 organisations found dangling CNAME records, a type of orphaned web address entry that criminals can hijack, at 31 of them.
- About a third of those vulnerable entries were reportedly easy for an outsider to take over.
- The product needs no software installed on a customer's systems and works without login credentials or active probing.
- Artificial intelligence is making attacker reconnaissance, mapping out a target before striking, dramatically faster, which is the commercial pressure driving this launch.
Security company Infoblox wants to find your open doors before a criminal does. This week it announced entry into the External Attack Surface Management (EASM) market, a category of tools that continuously scan everything a business has exposed to the internet and flag the weaknesses.
EASM has become one of the fastest-growing corners of cybersecurity because the old approach, running a manual check once a quarter, no longer keeps pace with attackers. As first reported by CSO Online, Infoblox framed the launch around one specific pressure: AI is now letting criminals map out a target's weaknesses in hours rather than weeks. Mukesh Gupta, Infoblox's chief product officer, said that acceleration makes continuous external visibility a necessary part of modern security operations.
What actually makes this different from the dozens of other tools doing the same job?
Infoblox's angle is DNS. DNS, short for Domain Name System, is the internet's address book: it translates a name like "yourbank.com" into the numerical address computers actually use to connect. Infoblox has spent years in that space, and it's applying that expertise here.
The practical upshot: the tool targets dangling CNAME records. A CNAME is a DNS entry that points one web address to another. When a company retires a service but forgets to delete the pointer, that orphaned entry sits in the open. A criminal can register the abandoned destination and suddenly controls an address that looks like it belongs to the real company, making phishing pages and fake login forms far more convincing.
| Stat | Figure |
|---|---|
| Organisations in early access program | ~40 |
| Found dangling CNAME records | 31 |
| Of those, entries easy to hijack | ~1 in 3 |
| Product launch date | Tuesday (this week) |
Those numbers are not flattering for the industry. Dangling records are a known, fixable problem. Finding them at three-quarters of tested organisations suggests routine DNS hygiene is still falling through the cracks. We first covered the EASM space on 17 June 2026, when Lumen Technologies discovered it owned 1.1 million internet-facing assets rather than the 17,000 it had counted: the visibility problem Infoblox is selling against is real.
Should customers of businesses using this product care?
Yes, indirectly. Supply Chain Intelligence, the second piece of Tuesday's announcement, monitors the internet-facing exposure of a company's own critical vendors. Your data can be stolen through a supplier's weak point just as easily as through your own front door.
When a vendor's leaked staff credentials or hijacked subdomain gets caught early, the downstream attack that would have reached you never launches. That's the value proposition, and it's a reasonable one.
The failure mode this product targets isn't exotic. It's forgotten infrastructure: old cloud storage buckets left public, expired certificates, abandoned subdomains. The boring stuff that falls off the sprint board and stays off it for months.
Infoblox is also not arriving here cold. We reported in July that the company's researchers track Lurking Lizard, a group running a rogue proxy network across 230-plus lookalike sites, so DNS-layer threat intelligence is genuinely part of what this company does day to day.
The post-mortem on every dangling-record hijack will say the same thing: somebody knew that entry was outdated and nobody deleted it.
