Attack surface management is becoming the first step in security

At a glance

What this is: This article explains attack surface management as the first step in security strategy and argues that external visibility is now necessary because unmanaged assets and hidden exposures create attack paths.

Why it matters: It matters to IAM practitioners because the same exposure problems that affect internet-facing systems also affect identity, secrets, and access boundaries, especially where assets are deployed outside formal control.

By the numbers:

• 58% of small and medium-sized enterprises experienced a cyberattack in the past year.
• Attackers attempt access within an average of 17 minutes when AWS credentials are exposed publicly, and as quickly as 9 minutes in some cases.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope.

👉 Read Cybertrust Japan's article on starting security with attack surface management

Context

Attack surface management is the practice of finding the assets an organisation exposes to the internet, then prioritising the weaknesses that attackers are most likely to use first. The security gap it addresses is simple: organisations often know what they built, but not everything that is reachable, inherited, shadowed, or poorly governed across cloud, SaaS, and outsourced environments.

That gap matters for identity and access because exposed assets are only one part of the problem. Unmanaged systems often carry service credentials, embedded secrets, or overly broad access paths, which means attack surface management can expose where IAM, secrets management, and lifecycle controls are failing in practice.

The starting position described in the article is typical rather than exceptional for digitally distributed organisations.

Key questions

Q: How should security teams use attack surface management to improve control over exposed systems?

A: Security teams should use attack surface management to find what is actually reachable, then connect each exposed asset to an owner, access path, and remediation SLA. The goal is not just visibility. It is to make sure exposed systems are tied to identity governance, secrets review, and a closure process that removes the attack path rather than documenting it.

Q: Why does external exposure often become an identity problem as well as a cloud problem?

A: External exposure becomes an identity problem because many reachable systems depend on service accounts, API keys, certificates, or delegated access that live longer than the workload itself. Once the system is publicly reachable, those credentials become part of the attack path. If identity owners do not know the asset exists, they cannot govern the access attached to it.

Q: What do security teams get wrong about attack surface management?

A: Teams often treat ASM as a scanning activity when it is really an operating model for continuous exposure control. Discovery without ownership, prioritisation, and remediation simply creates a bigger findings queue. The practical test is whether each exposed asset can be traced to an accountable team and a measurable fix.

Q: Who is accountable when an exposed asset becomes the entry point for a breach?

A: Accountability should sit with the team that owns the asset and the control function that governs its exposure, which often includes cloud, application, and identity owners together. In practice, frameworks like the NIST Cybersecurity Framework and NHI governance expect clear ownership, because unresolved exposure is a governance failure as much as a technical one.

Technical breakdown

How attack surface management changes the detection phase

Attack surface management focuses on the externally observable layer of an environment. Instead of waiting for an alert from an endpoint or SIEM, it continuously discovers public assets, subdomains, services, certificates, and other reachable entry points. That makes it different from internal vulnerability management, which usually starts after an asset is already known and onboarded. The value is not only enumeration. It is the ability to identify assets that exist outside the assumptions of central IT, including shadow systems and third-party exposures that create a wider attack window than teams expect.

Practical implication: build an authoritative inventory that reconciles externally discovered assets with CMDB, cloud, and IAM ownership data.

Why cyber kill chain thinking still matters for exposed assets

ASM is often described as a discovery layer, but its security value comes from mapping what attackers can do after they find a target. In the cyber kill chain, reconnaissance and weaponisation depend on identifying reachable services, misconfigurations, and exposed trust relationships. Once that path is known, attackers can move toward credential harvesting, access abuse, or exploitation of known services. The key insight is that the observable attack surface often determines whether the defender sees the attacker early enough to contain the event, or only after access has already been established.

Practical implication: score exposed assets by likely attacker progression, not by asset count alone.

Why external visibility must connect to access governance

ASM is most effective when it links to governance, not when it stops at visibility. A discovered service may look like a pure infrastructure issue, but the hidden risk is frequently identity-related: stale API keys, over-privileged service accounts, or orphaned access that no one owns. That is where identity governance, PAM, and NHI lifecycle controls become relevant. External exposure is often the symptom; weak access lifecycle is the cause. Without ownership and revocation paths, discovery only creates a backlog of known risk.

Practical implication: route every exposed asset to an owner, an entitlement review, and a remediation SLA.

Threat narrative

Attacker objective: The attacker wants a reachable foothold that can be turned into broader access, faster intrusion, and lower-cost exploitation.

1. Entry begins when attackers enumerate internet-facing assets, search for exposed services, and identify the easiest public paths into the environment.
2. Escalation follows when those exposed systems contain weak authentication, untracked credentials, or misconfigurations that allow broader access than intended.
3. Impact occurs when the exposed path leads to lateral movement, data theft, or service disruption before the organisation can close the gap.

NHI Mgmt Group analysis

Attack surface management is now an access governance problem as much as a discovery problem. The article is right to frame ASM as the first step, but discovery alone does not reduce risk unless it leads to ownership, entitlement review, and revocation. In practice, the most dangerous exposed systems are the ones carrying unmanaged credentials or inherited trust. For identity teams, this is where NHI lifecycle management and external asset visibility intersect. Practitioners should treat exposed assets as governance exceptions, not just technical findings.

External visibility exposes shadow IT that central IAM never had a chance to govern. The article highlights unmanaged devices, software, and cloud services introduced outside formal approval. That pattern matters because identity controls cannot protect what they cannot see, especially when service accounts, tokens, or embedded keys are deployed without registration. The named concept here is shadow exposure gap: assets that are reachable from the internet but absent from identity and ownership records. Practitioners should tie ASM output into asset ownership and identity lifecycle workflows.

ASM validates the move from periodic review to continuous control. Traditional vulnerability programmes often assume assets are stable long enough for scanning, ticketing, and remediation cycles. Internet-exposed environments invalidate that assumption because new assets appear, change, and disappear faster than quarterly review processes can absorb. This is especially relevant where machine identities and API credentials are attached to fast-moving cloud assets. Practitioners should use ASM to support continuous verification, not as a one-time audit exercise.

Identity sprawl becomes operationally visible when external attack paths are mapped. A public IP or open port is often only the first clue. The real governance question is which identities, secrets, and delegated access paths sit behind that exposure. That makes ASM a useful trigger for broader NHI and PAM review, especially where service accounts persist after the workload changes. Practitioners should connect exposure findings to the credentials and permissions that make those assets exploitable.

Security programmes that separate perimeter and identity are now carrying the risk in the wrong place. The article shows why attack surface reduction and identity governance should be treated as one workflow in distributed environments. If a service is reachable, the access model behind it matters immediately, not later. This is where CIS Controls, NIST CSF, and NHI governance meet operational reality. Practitioners should align exposure monitoring with access ownership and remediation authority.

What this signals

Shadow exposure gaps will keep widening unless attack surface data is tied directly to ownership, access governance, and offboarding. In distributed environments, the question is no longer whether a system is reachable, but whether the organisation can prove who owns it and what identity paths it exposes.

For identity teams, ASM should become an input to lifecycle controls, not a separate security dashboard. When internet-facing assets are discovered outside approved workflows, the associated credentials, tokens, and certificates need review against the same governance model used for other NHIs.

The next maturity step is continuous exposure control, where discovery, prioritisation, and remediation sit in one operating loop. That approach aligns naturally with the NIST Cybersecurity Framework and with the lifecycle discipline described in the NHI Lifecycle Management Guide.

For practitioners

• Create a continuously reconciled external asset inventory Pull ASM findings into the same inventory used for cloud, IAM, and service ownership so that every reachable asset has a named owner, business purpose, and remediation path.
• Tie exposed assets to identity and secrets review For each internet-facing asset, check whether it carries service accounts, API keys, certificates, or delegated access that outlived the workload or application.
• Set remediation SLAs by exposure path Prioritise assets that are directly reachable from the internet, then use a shorter SLA when the system contains privileged access, sensitive data, or unauthenticated entry points.
• Use ASM findings to drive ownership enforcement Send each exposure to the team that can actually fix it, then require closure evidence rather than a status update so hidden assets do not remain in the backlog.
• Map exposure trends to NHI lifecycle controls Where ASM finds workloads or services that persist outside normal deployment records, verify whether their credentials, tokens, and certificates are rotated and offboarded on schedule.

Key takeaways

• Attack surface management matters because exposure, not just vulnerability, determines whether attackers can even begin to move.
• The evidence in the article shows that small and medium-sized businesses face both frequent attacks and slower recovery, which makes early discovery materially important.
• The practical answer is to connect external discovery to ownership, identity review, and remediation authority so exposed systems do not remain governable only in theory.

Key terms

• Attack Surface Management: Attack Surface Management is the practice of continuously finding and assessing the assets an organisation exposes to attackers. It focuses on what is reachable from the outside, then links those findings to ownership, risk, and remediation so hidden entry points do not persist unmanaged.
• Attack Surface: An attack surface is the total set of ways an attacker can interact with a system, application, or organisation. In practice it includes public services, exposed credentials, unmanaged endpoints, and third-party connections that create opportunities for reconnaissance, exploitation, or access abuse.
• Shadow IT: Shadow IT is technology deployed or used outside formal approval, oversight, or governance. It becomes a security problem when unmanaged assets are externally reachable, because the organisation may not know what exists, who owns it, or what identities and secrets are attached to it.
• Exposure Path: An exposure path is the sequence of reachable assets, misconfigurations, and permissions that can carry an attacker from public discovery to meaningful access. Security teams use the term to describe how a weakness becomes exploitable, which makes it easier to prioritise real risk over isolated findings.

What's in the full article

Cybertrust Japan's full blog post covers the operational detail this post intentionally leaves for the source:

• How ASM is positioned as the first step in the security process, including the 7-stage cyber kill chain used in the article.
• Examples of ASM services that combine visibility, vulnerability diagnosis, penetration testing, and device identification.
• Practical explanations of how external asset discovery supports faster executive reporting and security investment decisions.
• The specific control flow from discovery to continuous monitoring that the source article recommends for distributed environments.

👉 Cybertrust Japan's full post covers ASM process detail, use cases, and deployment context.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is suitable for practitioners who need a stronger operating model for identity risk across distributed environments.