Attack Surface Management Defined in Plain Terms
Attack surface management is the continuous practice of finding, monitoring and reducing every point where an attacker could try to enter your systems, move through them or take data out. Your attack surface is the full set of those exposed points, spread across on-premises systems, cloud services, remote access and the suppliers connected to you.
The idea comes straight from how attackers work. The US National Institute of Standards and Technology defines an attack surface as the set of points on the boundary of a system where an attacker can try to enter, cause an effect or extract data. Every internet-facing server, login page, API and forgotten test box is one of those points.
This matters more each year because exposed assets have become the way in. In the Verizon 2025 Data Breach Investigations Report, exploitation of vulnerabilities was the initial access route in 20 percent of breaches, up 34 percent on the year before. Most of those assets were reachable long before anyone attacked them.
Why Your Attack Surface Keeps Growing
A modern attack surface grows on its own. Every new cloud account, SaaS subscription, API, remote laptop and acquired company adds assets that face outward and most appear faster than security teams hear about them.
Cloud platforms let a developer stand up a public database or storage bucket in minutes often with no central review. Remote and hybrid work push the boundary into home networks and personal devices. Software now runs on other software so every integration opens another public endpoint that has to be found and secured.
Each change is small and reasonable on its own. Together they open a steady gap between what you actually run and what you think you run and that gap is where attackers live.
Types of Attack Surface
Your attack surface is not one thing. It is several layers and each needs finding and watching in a different way.
- Internet-facing systems: Web servers, login portals, email and public IP ranges that anyone online can reach and probe.
- Cloud and SaaS assets: Storage buckets, databases, containers and third-party apps, often spun up outside central control.
- Remote access and edge devices: VPN gateways, firewalls and appliances that sit at the perimeter and are exposed by design.
- Shadow IT and forgotten assets: Old subdomains, test environments and tools nobody decommissioned or logged.
- Supply-chain connections: Suppliers, managed services and software with a path into your data or network.
- Human and identity surface: Accounts, credentials and access rights that phishing or a leaked password can turn into a way in.
Two disciplines map these from different angles. External attack surface management or EASM, looks from the outside in and discovers the internet-facing assets an attacker would find first. Cyber asset attack surface management, or CAASM, works from the inside out and pulls cloud, device and identity data into one deduplicated inventory. Both terms were coined by the analyst firm Gartner and are now standard vocabulary.
The Business Cost of Unmanaged Exposure
An unmanaged attack surface has a measurable cost and the Verizon 2025 Data Breach Investigations Report puts numbers on it. Exploitation of vulnerabilities was the initial access route in 20 percent of breaches, a 34 percent rise on the previous year.
The pressure has moved to the perimeter. Edge devices and VPNs made up 22 percent of the vulnerability exploitation Verizon tracked, up from 3 percent the year before, an almost eightfold increase. Only 54 percent of those edge flaws were fully patched over the year and the median time to do it was 32 days.
The surface you do not own counts too. Third-party involvement in breaches doubled to 30 percent and ransomware appeared in 44 percent of breaches. An exposed supplier or a single unpatched appliance is often the cheapest route in, so attackers take it.
Real-World Cases
MOVEit and the Exposed File Transfer App (2023)
In May 2023 the Cl0p ransomware group began mass-exploiting a critical flaw in Progress MOVEit Transfer, a file-transfer application many organisations expose to the internet. The vulnerability, CVE-2023-34362, carried a CVSS score of 9.8 and allowed SQL injection into the app.
Progress patched it within days but the window was enough. CISA and the FBI reported that the group compromised more than 3,000 US organisations and over 8,000 worldwide, many through a single supplier that ran MOVEit on their behalf. Knowing the app was internet-facing and retiring or isolating it was the difference.
Ivanti Connect Secure and the Perimeter Appliance (2024)
In January 2024 CISA issued its first emergency directive of the year over two chained vulnerabilities in Ivanti Connect Secure, a VPN appliance that sits on the network edge. CVE-2023-46805 allowed an authentication bypass and CVE-2024-21887 allowed command injection and together they were being mass-exploited.
The directive did two things at once. It told agencies to apply Ivanti’s mitigation immediately because no patch was yet available and it required them to report a complete inventory of every affected appliance to CISA within about a week. You cannot mitigate or account for a device you have not found which is why a full inventory sits at the heart of the response. Before you can fix an exposed device you have to know you have it.
Miljödata and the Supplier Surface (2025)
In August 2025 attackers hit Miljödata, a Swedish supplier of HR and work-environment software used by around 80 percent of the country’s municipalities. Swedish authorities confirmed the ransomware attack disrupted services at 164 municipalities and four regions and the data was later published when a ransom was refused.
More than 2.2 million people had personal records exposed including sick-leave and rehabilitation details. Not one of those municipalities was breached directly. Their exposure ran through a supplier they depended on which is exactly the part of the attack surface that inventories tend to miss.
Attack Surface Management and Compliance
Knowing and controlling your assets is no longer just good practice. Several regimes now require it and Swedish organisations sit under more than one.
NIS2 and Cybersäkerhetslagen put asset awareness into law. NIS2 is implemented in Sweden as Cybersäkerhetslagen (SFS 2025:1506), in force from 15 January 2026. Article 21 requires risk analysis and security measures that assume you know what you run and covers supply-chain security and Article 20 makes senior management personally accountable. Our NIS2 guide sets out the full duties.
DORA is explicit about it. The Digital Operational Resilience Act, Regulation (EU) 2022/2554, applies to financial entities and is supervised in Sweden by Finansinspektionen. Its Article 8 requires firms to identify, classify and document all ICT-supported functions, information assets and their dependencies and to review that map at least yearly. See our DORA guide.
ISO/IEC 27001 starts from the same place. Its 2022 revision opens Annex A control 5.9 with an inventory of information and associated assets, each with an owner and adds controls for vulnerability and configuration management. Our ISO 27001 guide covers the certification path.
How to Find Your Hidden Attack Surface
You cannot manage what you have not found so attack surface management starts with discovery from the outside in, the same way an attacker would map you.
- Certificate transparency and passive DNS: Public logs of issued certificates and historical DNS records reveal subdomains and hosts you may have forgotten.
- Internet-wide scanning: Services that continuously scan the public internet show which of your IP addresses and ports are open and what is running on them.
- Cloud and account enumeration: Querying your own cloud provider APIs surfaces storage, databases and services that never went through central review.
- Leaked credential and code searches: Public code repositories and breach data expose keys, tokens and logins that widen the surface.
Some exposure is visible if you look. Forgotten subdomains still resolving, development and test systems reachable from the internet, admin panels open to the public and cloud storage left world-readable are all common findings on a first scan.
The hard truth is that this work is never finished. The surface changes every time someone ships a service or opens an account so a one-off audit goes stale within weeks. CISA’s binding operational directive sets a pace worth borrowing. It requires US federal civilian agencies to run automated asset discovery every 7 days rather than once a quarter or once a year.
How to Reduce Your Attack Surface
Once you can see your attack surface, the goal is to make it smaller and keep it that way. The steps below are ordered and the first one is non-negotiable.
- Build one authoritative inventory: Keep a single, continuously updated record of every asset, who owns it and whether it faces the internet.
- Discover from the outside in: Scan your own perimeter regularly so you find exposed assets before an attacker does.
- Reduce what is exposed: Decommission dead systems, close unnecessary ports, take test environments off the public internet and put multi-factor authentication on every remote and admin login.
- Prioritise by real risk: Rank fixes using the CISA Known Exploited Vulnerabilities catalogue and exploit-prediction scoring rather than severity alone.
- Patch the edge fast: Treat internet-facing appliances and VPNs as urgent and measure how long they stay unpatched.
- Extend it to suppliers: Track which third parties connect to you and hold them to the same standard.
- Watch for change: Monitor continuously so new exposure is caught as it appears.
Reducing exposure connects directly to fixing the flaws you find which is the job of vulnerability management. Start with the inventory. Everything else depends on knowing what you have.
