Why your attack surface is bigger than your asset register
Most organisations defend what they know about. Adversaries attack what they can find. The difference is where breaches start.
Two different maps
Every organisation keeps some form of asset register. It lists the systems that were bought, built and approved. It has owners, review dates and a sense of order. It is also, almost always, incomplete.
An adversary does not read your register. They start from the outside and look for anything that answers. A forgotten test server. A campaign microsite built by an agency. A login page left behind after a migration. None of these need to be on your list to be on theirs.
The difference between the two maps is not a clerical problem. It is where many of our engagements find their first foothold.
How the gap opens
The gap rarely comes from negligence. It comes from the normal pace of a working organisation.
A project spins up infrastructure for a proof of concept, and the project ends before the infrastructure does. A supplier hosts something on your behalf, under your name. An acquisition arrives with its own estate and its own habits, and integration is planned for next year. Cloud accounts are created by people who needed to ship, and the register is maintained by someone else.
Each of these is reasonable in isolation. Together they produce an estate that is larger, older and less consistent than the one on paper.
Seeing it the way an adversary does
When we map an attack surface, we deliberately start with no inside knowledge. We work from what anyone could learn: names, registrations, certificates, public records, and the code and documents that have drifted into the open. From there we follow every thread that leads back to you.
The aim is not a longer list. It is a different kind of list, built from evidence of what is reachable rather than from records of what was approved.
Then we compare the two. The interesting findings are almost never in the overlap. They sit in the systems nobody remembers owning, and in the systems everyone remembers but which no longer look the way the register says they do.
Exposure is not risk
A large, unfamiliar attack surface can be alarming. It should not be paralysing. Much of what we find is of little use to an adversary. Some of it is not.
The work that matters is ranking. We ask what an adversary would actually do with each exposure: what it reveals, what it connects to and how far it could take them. A forgotten page with nothing behind it is housekeeping. A forgotten system that still trusts your internal network is a priority.
This is where intelligence earns its place. Knowing which techniques are in active use, and against which kinds of organisation, turns a long inventory into a short list of things to fix this week.
Keeping the picture current
An attack surface review starts to age the day it is delivered. New services appear, old ones change and suppliers make decisions on your behalf. A point-in-time map is useful. A continuous one is better.
That does not require a vast programme. It requires a habit: look from the outside regularly, compare what you see with what you expect, and treat every surprise as a question to answer rather than a line to file.
What to do about it
Start small, and start from the outside.
- Map your estate from the outside in, with no inside knowledge, and compare it honestly with your register.
- Rank every unexpected exposure by what an adversary could do with it, and fix the few that lead somewhere first.
- Make the outside-in view a recurring habit, so the next surprise is found by you rather than for you.