Attack Surface Management
What Is Attack Surface Management? A Complete Introduction
Attack surface management (ASM) is the continuous process of discovering, inventorying, classifying, and monitoring all of an organization's internet-facing and internal assets to identify and reduce security exposure. ASM answers "what can attackers see and target?" by finding assets that traditional inventory methods miss — including shadow IT, forgotten servers, misconfigured cloud resources, and exposed APIs.
Andreas Johansson · Chief Executive Officer
Senior IT management leader with 25 years of experience in Cloud, Security, and Datacenter infrastructure.
Defining Attack Surface Management
Your attack surface is the sum of all points where an unauthorized user could attempt to enter or extract data from your environment. Every server, API endpoint, web application, subdomain, cloud instance, IoT device, and network service that's accessible represents a potential entry point for attackers.
Attack surface management is the discipline of continuously discovering and managing these entry points — ensuring you know what's exposed, assessing the risk each asset presents, and reducing exposure to an acceptable level.
Why Traditional Approaches Fail
Asset Inventories Are Always Incomplete
Traditional IT asset management relies on documented inventories — CMDBs, spreadsheets, and procurement records. These capture assets that go through formal provisioning processes. But modern infrastructure is increasingly provisioned outside formal channels:
- Developers spin up cloud instances for testing and forget to decommission them
- Marketing deploys landing pages on new subdomains without IT involvement
- Departments adopt SaaS tools without security review
- Acquisitions bring entire unknown infrastructure into the organization
- Legacy systems persist long after the teams that built them have left
Asset inventories often miss internet-facing assets. Each unknown asset is an unmonitored, unpatched potential entry point.
Point-in-Time Assessments Miss Changes
Annual penetration tests and quarterly vulnerability scans provide snapshots — but the attack surface changes continuously. A new subdomain created on Monday, misconfigured on Tuesday, and discovered by an attacker on Wednesday won't appear until the next scheduled scan.
Internal Focus Misses External Perspective
Traditional security works from the inside out — protecting known assets within the network perimeter. ASM works from the outside in — discovering what attackers can see and target. The attacker's perspective often reveals exposures that internal teams don't recognize.
What ASM Discovers
Known Unknowns
Assets that someone in the organization knows about but that aren't tracked by security — development environments, departmental websites, experimental APIs, and tools deployed by individual teams.
Unknown Unknowns
Assets that nobody in the organization is aware of — legacy systems from previous IT regimes, forgotten test servers, subdomains created by former employees, misconfigured cloud resources that expose services unintentionally, and assets inherited through acquisitions.
Third-Party Exposures
Assets controlled by vendors, partners, or service providers that connect to your environment or handle your data. A vendor's security weakness can become your breach.
The ASM Process
1. Discovery
Find all assets associated with your organization. Methods include:
- DNS enumeration. Discovering all subdomains, DNS records, and related domains
- Certificate transparency. Monitoring CT logs for certificates issued to your domains
- IP range analysis. Identifying all IP addresses associated with your organization
- Cloud account inventory. Enumerating assets across all cloud accounts and regions
- Search engine analysis. Finding indexed pages, documents, and services
- Dark web monitoring. Identifying leaked credentials or references to your infrastructure
2. Attribution
Determining which discovered assets actually belong to your organization. Not every asset on your IP range is yours (shared hosting), and assets on third-party infrastructure may be yours (cloud, SaaS, CDN).
3. Classification
Categorizing assets by:
- Type: Web server, API, database, mail server, IoT device
- Technology: Operating system, web server, framework, CMS
- Function: Production, staging, development, test
- Owner: Which team or department is responsible
- Criticality: Business impact if compromised
4. Risk Assessment
Evaluating risk based on:
- Known vulnerabilities in the detected technology stack
- Configuration issues (default credentials, open admin panels, debugging enabled)
- Data exposure (sensitive information accessible without authentication)
- Compliance implications (PII processing, regulated data handling)
- Network exposure (directly internet-facing vs behind CDN/WAF)
5. Continuous Monitoring
ASM is not a one-time scan — it's continuous:
- New assets detected as they appear
- Configuration changes tracked over time
- Vulnerability status updated as new CVEs are disclosed
- Risk scores recalculated as the threat landscape evolves
ASM Outcomes
Effective ASM delivers:
- Complete visibility — knowing your full attack surface, not just the documented portion
- Risk reduction — eliminating unnecessary exposure by decommissioning unneeded assets
- Faster response — detecting new exposures in hours rather than months
- Better prioritization — focusing security resources on the most exposed and critical assets
- Compliance support — demonstrating continuous awareness and management of your digital footprint
How SeqOps fits
SeqOps covers the cloud and server part of your attack surface: it inventories resources in your connected cloud accounts and flags exposed services and misconfigurations. It doesn't scan the internet for assets you haven't connected.