What Is Attack Surface Management?

Attack surface management is the continuous discovery and monitoring of everything an organisation exposes to the internet — domains, addresses, services, applications, certificates and cloud resources.

The premise is that most organisations do not know their own external footprint, and an attacker enumerating it is working from a more complete picture than the defenders are.

Why the footprint is unknown

It accumulates. Marketing registers domains for campaigns. Developers spin up cloud environments for testing. Acquisitions bring infrastructure nobody catalogued. Vendors host services on subdomains. Projects end and their infrastructure does not.

None of those pass through a process that records them, which is why discovery has to work from the outside in — from registration records, certificate transparency and internet-wide scanning — rather than from an internal inventory.

What discovery consistently finds

Forgotten development and staging environments, frequently with weaker authentication and real data. Administrative interfaces exposed that were meant to be internal. Expired or misissued certificates. Subdomains pointing at decommissioned cloud resources that someone else can claim.

And services running versions long out of support, on systems nobody has owned since the person who built them left.

Continuous, because the surface changes daily

A point-in-time assessment describes the footprint on the day it ran. Cloud resources appear and disappear, certificates are issued, services are published, and a quarterly review misses almost everything that matters.

The useful mode is monitoring with alerting on change: a new service exposed, a new subdomain resolving, a certificate issued for a name nobody recognises.

Findings need an owner, or nothing happens

The characteristic failure is a growing inventory of exposed assets with nobody accountable for any of them. Discovery is the easy half; deciding what each thing is for, whether it is still needed and who owns it is the work.

A useful default is that anything with no identifiable owner should be a candidate for decommissioning, with a notice period rather than an immediate shutdown.

Decommissioning is the cheapest remediation available

A substantial share of external exposure is infrastructure that serves no current purpose. Turning it off removes the risk entirely, costs nothing ongoing, and requires no patching or monitoring thereafter.

It is also the remediation most likely to be deferred, because nobody is certain it is unused. A monitored shutdown — disable, watch for complaints, remove — resolves that uncertainty safely.

The internal surface deserves the same question

External discovery asks what an outsider can reach. The companion question — what a single compromised internal host can reach — is answered by network design rather than by discovery tooling, and it determines how far an intrusion travels.

Both questions matter and the second is more consequential once initial access has happened, which it eventually will. An organisation with a small external footprint and a flat internal network has managed the less important half.

Where to start

Run an external discovery against your own domains and compare what comes back with what you believed you had. The difference is the argument for doing this continuously.

See decommissioning legacy systems safely. GuardsArm runs external penetration testing.