TL;DR: Attack surface management treats every internet-reachable asset as a potential foothold, and Intruder’s 2026 index says 60% of organisations expose HTTP panels, more than a quarter expose MySQL, and 11% leave Remote Desktop open. The lesson for IAM and security teams is that exposure control, not just vulnerability scanning, is now part of identity and access governance.
At a glance
What this is: Intruder argues that attack surface management is about reducing internet reachability, not just patching vulnerabilities, because exposed assets can become footholds before any CVE appears.
Why it matters: For IAM and security teams, the operational question is whether exposed login surfaces, admin panels and remote services are governed as access-risk issues, not only as scanning targets.
By the numbers:
- 60% of organisations have an exposed HTTP panel.
- 11% of organisations have Remote Desktop exposed to the internet.
Context
Attack surface management is the continuous discovery and reduction of everything an attacker can reach from the internet. The governance gap is that many programmes still treat exposure as an inventory problem or a vulnerability problem, when the real issue is whether a system should be reachable at all.
That distinction matters for identity and access governance because exposed admin panels, databases and remote access services become authentication targets before they become software problems. When exposure is unmanaged, access control starts at the wrong point in the attack path: after the asset is already public.
Cloud growth, third-party services and shadow IT make this harder because the attack surface changes faster than periodic reviews or scan cycles. The typical starting position described here is common, not exceptional, which is why exposure management has to be continuous.
Key questions
Q: What breaks when exposed infrastructure is not removed from the internet?
A: When infrastructure stays publicly reachable without a business need, attackers can target login pages, admin consoles and databases directly. That exposure turns weak passwords, reused credentials and future vulnerabilities into immediate risk. The failure is not only technical. It is governance drift, because security teams lose control over what is reachable and therefore attackable.
Q: Why does an exposed admin panel increase compromise risk even without a CVE?
A: An exposed admin panel gives attackers a live authentication target. Even if the software is current, they can still try reused credentials, default passwords or slow guessing attacks. The risk comes from reachability plus authentication, not from a published vulnerability. That is why exposure reduction has to sit alongside patch management.
Q: What are the signs that manufacturing attack surface management is failing?
A: Common warning signs include unknown internet-facing assets, delayed remediation of exposed vulnerabilities, inconsistent inventory records across teams, and weak visibility into third-party exposures. If security teams cannot quickly identify what is exposed, which systems matter most, or whether remediation has actually reduced risk, the programme is not providing actionable control. Effective attack surface management should shrink uncertainty, not just generate more findings.
A: They should do both, but external attack surface management should come first for internet-facing systems. Scanners tell you what is vulnerable; exposure management tells you what an attacker can actually reach. Without that distinction, teams spend time patching assets that are not exposed while missing the systems most likely to be attacked.
Technical breakdown
Why exposed infrastructure becomes an attack path
An exposed system is not just a scanning target. It is a live entry point that attackers can probe with password guessing, credential stuffing, default credentials or session abuse long before anyone sees a CVE. The security problem is that reachability creates opportunity, and the internet does not distinguish between a well-managed login page and a forgotten admin panel. Attack surface management focuses on eliminating unnecessary reachability so the attacker never gets that first look at the interface.
Practical implication: treat public reachability as an access-control decision, not only a vulnerability-management outcome.
How ASM differs from vulnerability management
Vulnerability management asks what is broken in what you already exposed. Attack surface management asks what should not be exposed in the first place. That difference matters because a secure service can still be an unacceptable risk if it sits on the internet, especially when future vulnerabilities or credential reuse can turn it into a foothold overnight. ASM therefore shifts the control point earlier, from patching to exposure reduction and asset removal.
Practical implication: use ASM to remove unnecessary services before the next disclosure turns them into incident material.
Why cloud and shadow IT expand exposure faster than controls
Cloud platforms let teams create services faster than central change control can track them, and third-party integrations add more externally reachable surfaces that security teams may not fully inventory. The result is exposure drift, where the live attack surface no longer matches the approved one. In identity terms, this also widens the number of login surfaces and administrative pathways that can be targeted, audited, or abused without a corresponding governance record.
Practical implication: connect cloud asset discovery to access governance so new internet-facing services are reviewed as soon as they appear.
Threat narrative
Attacker objective: The attacker wants a low-friction foothold through exposed infrastructure so they can access systems, data or administrative functions before defenders notice the exposure.
- Entry begins with an internet-exposed admin panel, database or remote access service that an attacker can find through external reconnaissance.
- Credential abuse follows when the attacker tries reused passwords, guessed credentials or other weak authentication against that exposed surface.
- Impact occurs when the exposed service gives the attacker an initial foothold, data access or a path to broader compromise without any exploit chain involving a CVE.
Breaches seen in the wild
- MongoBleed breach: MongoBleed exposed secrets across 87K MongoDB servers.
- Firebase misconfiguration exposure 2024: Missing Firebase security rules on 916 websites exposed 125 million user records and 19.87 million plaintext passwords; a quarter were fixed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Exposure management is becoming an identity governance problem, not just a perimeter problem. When an admin panel, database or remote desktop service is public, the first control issue is who or what can authenticate to it, not whether a scanner finds a CVE. That makes external attack surface a governance domain for IAM and PAM teams as much as for security operations. Practitioners should treat every exposed login surface as part of the governed access estate.
Unnecessary reachability is a control failure because it widens the attacker's authentication workspace. If a service is online without a business reason, it creates more places for reused credentials, weak passwords and default access paths to be tested. The article's central lesson is that exposure itself creates risk before exploitation exists. Practitioners should remove public reachability from services that do not require it.
Cloud velocity creates exposure drift faster than traditional asset inventory can absorb. Teams that spin up services directly in AWS, Azure or Google Cloud often bypass the records that IAM, PAM and security review depend on. That is how shadow IT becomes shadow exposure. Practitioners should assume the live attack surface changes continuously and govern discovery accordingly.
Attack surface management closes the gap between what security teams think is public and what attackers can actually reach. The named concept here is exposure drift, the steady divergence between approved assets and live internet-facing assets. Once that drift exists, vulnerability scanning can only react to the wrong set of targets. Practitioners should reduce exposure first, then scan what remains.
From our research library:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
What this signals
Exposure drift is now a standing governance issue for cloud and IAM teams. Every new internet-facing service changes the control problem, because the reachable asset set can expand faster than periodic reviews can close it. Practitioners should assume external exposure will outpace static inventory unless discovery is continuous and tied to access governance.
Attack surface management only works when it is treated as a lifecycle control. Discovery, assessment and removal have to repeat every time a service, subdomain or integration changes. The programme implication is straightforward: if exposure review is periodic, the attacker gets the advantage of time.
For practitioners
- Map every internet-facing login surface Inventory admin panels, databases, Remote Desktop, login pages, subdomains and cloud services that are reachable from the internet, then compare them to approved business need.
- Remove unnecessary public reachability Decommission forgotten assets, move administrative interfaces behind private access paths, and close ports or services that do not need external exposure.
- Tie cloud discovery to access review Feed cloud account and service discovery into IAM and PAM reviews so newly exposed services are assessed as soon as they appear, not at the next periodic audit.
- Prioritise exposed authentication points first Start remediation with assets that accept credentials, because exposed login surfaces are the easiest path from exposure to initial access.
Key takeaways
- Exposed infrastructure is a security problem in its own right, because reachability gives attackers a foothold even when no CVE exists.
- Intruder’s index shows that public HTTP panels, MySQL instances and Remote Desktop exposure remain common enough to make external reachability a board-relevant risk.
- The practical response is to remove unnecessary public access first, then scan and patch what still needs to be online.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Public admin panels and exposed services are access-governance problems, not only scan findings. |
| Recommendation — Apply PR.AA-05 to restrict internet-facing access to only the services that genuinely need it. | ||
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | ASM depends on knowing which externally reachable assets actually exist. |
| Recommendation — Use CIS-1 to maintain a current inventory of internet-facing assets and remove unknown systems. | ||
| MITRE ATT&CK | TA0001;TA0006 — Initial Access; Credential Access | Exposed services support the initial access and credential abuse patterns described in the article. |
| Recommendation — Map exposed login surfaces to TA0001 and TA0006 and prioritise them for containment. | ||
| NIST SP 800-53 Rev 5 | CA-7 — Continuous Monitoring | The article’s continuous discovery model aligns with ongoing monitoring of externally reachable assets. |
| Recommendation — Use CA-7 to monitor external exposure continuously rather than relying on periodic scans. | ||
Key terms
- Attack Surface Management: Attack surface management is the practice of finding and evaluating assets that could be exposed to misuse or compromise. CAASM focuses on internal visibility across the environment, while EASM focuses on externally reachable assets. It is a discovery discipline, not a complete identity control model.
- Exposure Drift: Exposure drift is the gap between the state a security team last validated and the state the environment has reached since then. In fast-changing cloud and identity-heavy environments, that gap can be large enough to make a previous pentest result unreliable for operational decisions.
- Digital Attack Surface: The digital attack surface is the set of internet-facing systems, applications, endpoints, cloud services, and APIs that can be reached or abused by an external actor. It changes constantly as environments expand, so teams need ongoing discovery and monitoring rather than one-time inventories or periodic scans.
- Shadow IT Exposure: Shadow IT exposure is externally reachable infrastructure created outside formal governance processes. It matters because an unmanaged service can still accept traffic, authenticate users or expose data, even when it never entered the official security review path.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the broader access and exposure risks that shape modern security programmes.
Published by the NHIMG editorial team on August 18, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org