Attack surface exposure is outrunning patch-first security models

At a glance

What this is: This is an attack surface management report showing that exposed panels, services, databases, and public files remain common across organisations, with midmarket remediation lagging most.

Why it matters: It matters because exposed internet-facing services and admin surfaces often become the entry point for credential theft, privilege abuse, and follow-on identity compromise across NHI and human access paths.

By the numbers:

• 60% of organisations had at least one HTTP panel exposed.
• 49% of organisations exposed a risky port or service.
• 42% of organisations had an exposed database.
• Midmarket remediation peaked at 56 days for organisations with 5,000 to 10,000 employees.

👉 Read Intruder's 2026 Attack Surface Management Index on exposed panels, services, and databases

Context

Attack surface exposure is what happens when internet-facing systems, panels, ports, databases, or public files are reachable without a strong business case. In practice, that creates a larger control problem than patching alone can solve, because the attacker does not need a vulnerability if the service should not have been exposed in the first place. For IAM and NHI programmes, exposed admin interfaces also expand the ways credentials, tokens, and sessions can be stolen or reused.

Intruder’s 2026 Attack Surface Management Index argues that exposure, not just vulnerability, is the governance gap. The report’s findings show why identity teams should care: publicly reachable infrastructure often becomes the first step in compromise, then hands attackers an authentication target, a service account path, or a management console with weak access controls.

The pattern is typical rather than exceptional. Large enough environments accumulate exposed services faster than teams can remove them, which means the issue is structural, not occasional.

Key questions

Q: How should security teams reduce risk from exposed internet-facing admin panels?

A: Start by identifying every externally reachable management interface, then remove public access unless there is a documented business need. Add strong authentication, network restriction, and ownership for each panel. The goal is to stop treating admin reachability as harmless because the interface is private in design; if it is public in practice, it is part of the attack surface.

Q: Why do exposed databases and file shares create identity risk?

A: Because they often contain secrets, tokens, and session material that let attackers bypass normal login flows. An exposed database is not only a data loss problem. It can become a credential source that compromises NHI accounts, service accounts, and downstream applications that trust those identities.

Q: What breaks when patching is the only response to exposure?

A: Patch-only programmes leave the underlying reachability problem untouched, so attackers can still discover and target the asset while remediation is queued. That creates exposure lag, where the service remains public long enough to be scanned, brute-forced, or abused before the fix is applied.

Q: Who is accountable when a service account breach exposes customer data?

A: Accountability sits with the team that owns the application, the identity lifecycle, and the control environment around the service account. If no owner can explain why the credential existed, how it was rotated, and what it could access, governance has failed. Frameworks such as OWASP-NHI and NIST CSF both point to clear ownership and recoverability.

Technical breakdown

Exposed admin panels create initial access without a CVE

An exposed admin panel is a direct access path to a management interface that was often meant to stay internal. If the panel has weak passwords, reused credentials, or no additional hardening, attackers can get in without exploiting a software flaw. This is why exposure management and identity control are linked: the interface itself becomes the attack vector, and every credential behind it is now part of the threat model. Once a panel is internet-facing, brute force, password reuse, and social engineering all become viable entry methods.

Practical implication: classify admin panels as identity-bearing assets and remove or protect any panel that does not need public reachability.

Public databases and files turn discovery into immediate abuse

Databases and public files are high-value because they can expose credentials, API keys, session tokens, or sensitive records directly. A database that is exposed to the internet does not need an exploit to be dangerous if authentication is weak or data is stored insecurely. In identity terms, this is often where non-human credentials leak into plain view, giving attackers a shortcut into cloud services, application back ends, or automation workflows. The risk is amplified when the exposed asset contains secrets used by service accounts or deployment pipelines.

Practical implication: inventory all internet-reachable data stores and file shares, then verify they cannot reveal secrets or tokens even if discovery occurs.

Patch velocity is not the same as exposure reduction

Patch management addresses known software flaws, but exposure reduction asks whether the asset should be reachable at all. Those are different controls with different timelines. If an exposed system is patched slowly, the window of opportunity grows; if it should never have been public, the real fix is to change placement, access policy, or routing. This matters for NHI and human identity alike because internet exposure often creates the conditions for credential harvesting, session theft, and unauthorized administrative access before any vulnerability is involved.

Practical implication: pair patch workflows with exposure reviews so that removal from the internet can happen before remediation queues finish.

Threat narrative

Attacker objective: The attacker’s objective is to turn simple exposure into authenticated access that can be reused for broader compromise across applications, cloud services, or automation workflows.

1. Entry begins with a reachable internet-facing panel, database, or file share that was never intended to be public.
2. Escalation follows when attackers use weak, reused, or exposed credentials to move from visibility to authenticated access, or when they steal secrets directly from the exposed system.
3. Impact comes from administrative takeover, secret theft, service abuse, or access to downstream applications and cloud resources that trust the compromised identity.

Breaches seen in the wild

• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.
• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exposure governance is now a first-order identity control problem. The report shows that the risk begins before authentication, not after it. When panels, databases, and service interfaces are public, identity controls inherit a larger attack surface and weaker assumptions about who can even reach the asset. Practitioners should treat reachability as part of identity governance, not as a separate infrastructure issue.

Secret-bearing assets change the meaning of external exposure. Public databases and admin tools are not just availability risks. They often hold API keys, tokens, and session data that let attackers bypass normal access paths and move straight into NHI or application trust relationships. The governance gap is the assumption that secrets are safe because the asset is internal by design. Practitioners should assume any exposed management surface may already be an identity compromise.

Patch-first programmes create remediation latency debt. This report reinforces a common failure mode: teams respond to the alert, not the exposure condition. If the vulnerable service remains public for days or weeks, attackers have enough time to find it, probe it, and exploit it. The named concept here is exposure lag, the period between public reachability and actual removal from the internet. Practitioners should measure and shorten that lag directly.

NHI governance must account for admin surfaces, not just workload credentials. The intersection with identity is clear when exposed systems can reveal service account secrets or grant privileged back-end access. That makes NHI lifecycle controls, secret hygiene, and service-to-service trust part of the same control plane as perimeter exposure management. Practitioners should align exposure reduction with NHI inventory and entitlement review.

From our research:

• Strongly related exposure patterns are visible in our research: 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to The State of Secrets Sprawl 2026.
• Our research also found that 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, showing how new tooling can create fresh identity leakage paths.
• For a broader identity view, see Guide to the Secret Sprawl Challenge for the control patterns that reduce exposure before attackers find it.

What this signals

Exposure lag: the time between a service becoming public and being removed or restricted is now a material security metric, not an operational afterthought. Teams that only track patch SLAs miss the period attackers actually exploit, especially when internet-facing admin surfaces can be discovered almost immediately.

Identity programmes need to widen their scope from credential lifecycle alone to include the surfaces that expose those credentials. If a database, panel, or file share can reveal secrets, then IAM, PAM, and NHI controls must be coordinated with attack surface management and asset ownership.

The practical signal for mature programmes is simple: public reachability should be justified, measured, and reduced with the same discipline used for privileged access. That is where secret sprawl and exposure management begin to converge.

For practitioners

• Map every internet-facing management surface Create a live inventory of HTTP panels, RDP, databases, and admin tools that are reachable from the public internet, then assign ownership for each one. Use that inventory to decide whether the exposure is justified, temporary, or unnecessary.
• Remove public reachability before patching When a service is externally reachable without a strong business requirement, take it off the internet first and then patch or harden it. That sequence reduces attacker dwell time and avoids treating patch velocity as the only success metric.
• Treat exposed databases as secret leakage risks Check exposed databases and admin consoles for API keys, session tokens, service account credentials, and configuration exports. If a datastore or tool can reveal secrets, treat it as an identity incident candidate, not just a vulnerability finding.
• Measure exposure lag as a security KPI Track the time between first public exposure and removal from the internet, then compare that to your patch SLA. A short patch window does not help if the asset stays reachable for weeks.

Key takeaways

• The main risk is not just vulnerable software, but unnecessary public reachability that creates an easier entry path for attackers.
• Intruder’s data shows that exposed panels, services, and databases remain common, and midmarket teams can take weeks to remove them.
• The strongest control shift is to reduce exposure before patching, while treating exposed identities and secrets as part of the same governance problem.

Key terms

• Exposure Surface: The set of data, endpoints, and signals that can be observed or queried by an external party. For identity security, the exposure surface is broader than the access surface because publicly visible fields can still be abused for recon and profiling.
• Endpoint Exposure Lag: Endpoint exposure lag is the time between introducing a route in code and having governance controls recognise and evaluate its risk. The shorter that lag, the less opportunity attackers have to reach a newly exposed endpoint before security teams can act.
• Internet-facing Admin Panel: An internet-facing admin panel is a management interface accessible from the public internet rather than an internal network. It becomes risky when authentication is weak, credentials are reused, or the panel exposes controls that can lead directly to privilege abuse or secret theft.
• Secret-bearing Asset: A secret-bearing asset is any system that can store, display, or transmit credentials such as API keys, tokens, certificates, or session values. Exposing these assets is dangerous because discovery alone can hand attackers the material needed to impersonate services or users.

What's in the full report

Intruder's full index covers the operational detail this post intentionally leaves for the source:

• Per-exposure remediation benchmarks across organisation size bands, useful for comparing your own removal timelines.
• The ranked list of the top 10 exposed asset types, including MySQL, Postgres, RDP, and WordPress admin panels.
• The methodology behind the 3,000 attack surface sample and how Intruder classified exposure categories.
• The report’s benchmark data on growth-stage exposure differences, which helps teams justify headcount and tooling changes.

👉 Intruder's full index includes remediation benchmarks, exposure rankings, and the underlying measurement approach.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle control. It is designed for practitioners who need a structured way to connect identity risk to operational security decisions.