Why your attack surface is bigger than your asset register
Most organisations defend what they know about. Adversaries attack what they can find. The difference is where breaches start.
Two different maps
Every organisation keeps an asset register: the systems that were bought or built, with owners and review dates. In our engagements it is usually well kept, and it still misses a large part of what an adversary can reach.
An adversary works from the outside and looks for anything that answers. A test server a project left running. A campaign microsite an agency built under your name. A login page that outlived the migration behind it. None of those need an entry in the register to be a way in.
The gap between the two maps is where many of our engagements find their first foothold.
How the gap opens
The gap grows at the normal pace of a working organisation. A proof of concept gets infrastructure, and the project ends before the infrastructure does. A supplier hosts something on your behalf under your domain. An acquisition arrives with its own estate, and integration is planned for next year. Cloud accounts are created by the people who needed to ship, while the register is maintained by someone else.
Each decision is reasonable on its own. Over a few years they add up to an estate that is older and more varied than the one on paper.
Seeing it the way an adversary does
When we map an attack surface we start with no inside knowledge. We work from what anyone can learn: domain names, certificates, registrations, public records, and the code and documents that have drifted into the open. We follow every thread that leads back to you until the threads run out.
The result is a list built from evidence of what is reachable, rather than from records of what was approved. Then we lay it over the register. The interesting findings sit outside the overlap: systems nobody remembers owning, and systems everyone remembers that no longer look the way the register says.
Ranking what you find
A large, unfamiliar attack surface can look alarming. Much of it is of little use to an adversary, and some of it is a route straight to what you would least like to lose. The work is telling the two apart.
For each exposure we ask what an adversary could do with it: what it reveals, what it connects to and how far it could take them. A forgotten page with nothing behind it is housekeeping. A forgotten system that still trusts your internal network goes to the top of the list.
Threat intelligence sharpens the ranking. Knowing which techniques are in use against organisations like yours turns a long inventory into the handful of things to fix this week.
Keeping the picture current
An attack surface review starts to age the day it is delivered. New services appear, old ones change and suppliers make decisions on your behalf. A map that is rebuilt continuously stays useful; one that is rebuilt once a year mostly records history.
Continuous can be a small habit: look from the outside on a schedule, compare what you see with what you expect, and treat every surprise as a question to answer.
What to do about it
Start small, and start from the outside.
- Map your estate from the outside in, with no inside knowledge, and lay it over your register.
- Rank every unexpected exposure by what an adversary could do with it, and fix the ones that lead somewhere first.
- Repeat the outside-in view on a schedule, so you find the next surprise before anyone else does.