Attack surface management
Attack surface management is the ongoing work of discovering, understanding, monitoring, and reducing the exposure of the systems and entry points an attacker could reach.
Finding it is the beginning
An attack surface describes where an attacker could interact with an environment. Managing it means keeping that understanding current and doing something about exposure that should not be there.
An unfamiliar internet-facing service needs an owner and an explanation. It may be an approved service, something forgotten after a project, or an asset incorrectly associated with the organization. Discovery gives the team something to investigate, not an automatic vulnerability finding.
External visibility has limits
External attack surface management, often shortened to EASM, focuses on what can be discovered from outside the organization. NCSC’s buyers guide distinguishes that focus from internal scanning and explains that products offer different capabilities. Check the actual coverage rather than assuming the label includes every cloud, internal, or physical entry point.
A publicly reachable service is not proof that an attacker can compromise it. An attack path describes a possible sequence; an authorized test can establish what happens under specified conditions. Keep discovered exposure, suspected weaknesses, and demonstrated access separate.
The same care applies when reviewing public information about staff and suppliers. The reconnaissance article covers information that could support impersonation. A technical asset-discovery tool does not necessarily assess how a help desk verifies the resulting request.
Assign discovered assets to an owner who can decide whether to keep, fix, or retire them. Recheck the inventory as services and domains change.