The problem with perimeter thinking
For years, security was built around the idea of a perimeter — a defined boundary between "inside" and "outside." Firewalls, DMZs, and network segmentation all made sense in a world where your infrastructure lived in a data centre you controlled.
That world is mostly gone.
Today, the average organisation's external attack surface includes cloud storage buckets, SaaS applications with OAuth integrations, forgotten subdomains from decommissioned projects, third-party APIs, employee personal devices, and dozens of other entry points that nobody catalogued when they were created.
An attacker doesn't need to breach your firewall. They'll look for the subdomain you spun up for a marketing campaign in 2022 and never took down. They'll find the S3 bucket your developer made public "just for testing." They'll notice the VPN appliance running firmware from three years ago.
What attack surface management actually means
Attack surface management (ASM) is the continuous process of discovering, cataloguing, and assessing everything that's externally accessible and potentially exploitable. The key word is continuous — your attack surface changes every time someone spins up a new service, registers a domain, or connects a new SaaS tool.
From a practical standpoint, your attack surface includes:
Known assets — the infrastructure you know about and (hopefully) manage. Your primary domain, your corporate web applications, your VPN gateways. These are the things on your asset register.
Unknown assets — infrastructure you've forgotten about, inherited through acquisitions, or never tracked in the first place. Subsidiary domains, legacy applications, cloud resources created outside of normal change management processes.
Third-party assets — services and infrastructure you don't own but that attackers can use to reach you. Your email provider's authentication flow, your CDN's configuration, your supply chain.
How attackers enumerate your surface
When we begin a penetration testing engagement, our reconnaissance phase is essentially an attacker's-eye view of your organisation. We use a combination of passive and active techniques to build a picture before we touch anything:
DNS enumeration looks for subdomains — both current and historical. Tools like certificate transparency logs reveal subdomains that were issued SSL certificates, even if they've been "deleted."
OSINT pulls from public sources: job postings (which reveal your technology stack), LinkedIn (which shows your team structure and potential phishing targets), code repositories (which sometimes contain credentials and internal IP addresses), and historical data from web archives.
Port scanning and service fingerprinting identifies what's running on your externally reachable IP addresses — and critically, what version of that software is running.
Credential exposure checking looks for leaked credentials in breach databases and paste sites. A set of valid credentials found in a public breach can render most of your technical controls irrelevant.
The uncomfortable truth is that most of this reconnaissance takes less than a day. An attacker has the same tools we do.
Getting ahead of it
The good news is that the same techniques work defensively. Here's a practical starting point:
Start with your DNS. Pull all your DNS records, including historical ones via certificate transparency. You'll likely find assets you'd forgotten about. For each one, ask: is this still needed? If yes, is it patched and monitored? If no, decommission it.
Check your cloud. Run a configuration review across your cloud environments looking for public storage, open security groups, and unauthenticated services. Cloud misconfiguration remains one of the most common initial access vectors we see in real engagements.
Search for your credentials. Use services that aggregate breach data to check whether any credentials associated with your domains have been exposed. Enforce MFA everywhere — but also look for the credentials themselves, not just the mitigation.
Map your third parties. Understand which SaaS tools have access to your data and systems, and what your exposure is if one of those providers is compromised.
Commission external reconnaissance. Have someone with no prior knowledge of your environment conduct a black-box reconnaissance exercise. The gap between what you think is visible and what a practitioner finds is often significant.
The ongoing challenge
Attack surface management isn't a project — it's a programme. Your surface grows and shifts constantly, and point-in-time assessments have a shelf life.
The most mature organisations treat ASM as a continuous process, with automated discovery feeding into a risk register that's reviewed regularly. Not everyone has the resources to run this internally, which is why retainer-based advisory and Security Support SLAs exist — to give organisations access to that kind of continuous oversight without the in-house overhead.
If you don't have a clear picture of what attackers can see when they look at your organisation, that's the first problem to solve. Everything else follows from it.
CYSMIQ conducts external attack surface assessments as part of our penetration testing engagements and as standalone reconnaissance reviews. Get in touch to discuss your external exposure.