Continuous attack surface management replaces quarterly blind spots

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Cyble's report: Quarterly external attack surface scans cannot keep pace with cloud change, leaving newly exposed assets unmonitored for months.

Why it matters: Security and IAM practitioners need continuous discovery because cloud sprawl, drift and self-service provisioning can expose assets faster than scheduled review cycles can detect them.

By the numbers:

• CISA's Binding Operational Directive 23-01 requires automated asset discovery every 7 days and vulnerability enumeration every 14 days.
• The FBI's 2025 Internet Crime Report recorded 1,008,597 complaints and $20.877 billion in reported losses, a 26% increase over 2024.
• ENISA's Threat Landscape 2025 found that vulnerability exploitation accounted for 21.3% of initial access in the EU.

Context

External attack surface management is the discipline of discovering what an attacker can see from the internet and tracking how that exposure changes over time. In cloud environments, that exposure changes faster than periodic assessment cycles can reliably capture, especially when developers, contractors and business units can create assets without central review. Attack Surface Management Guide

The governance gap is not discovery in the abstract but timing. A scan that is accurate on Monday can be stale by Thursday when infrastructure as code, DNS changes and short-lived workloads create new exposure before the next review window.

That makes the problem partly a visibility problem and partly an ownership problem. If no team is accountable for newly exposed assets within hours, the organisation is relying on a control cadence that no longer matches cloud reality.

Key questions

Q: How should teams assess external exposure across cloud assets without relying on deep provider-specific knowledge?

A: Teams should use a cloud-agnostic view that links network exposure, identity permissions, and asset configuration in one model. The goal is to understand how internet reachability, VPC or security group rules, and attached identities combine to create risk. That makes it easier for operations staff and security teams to spot exposed paths to sensitive assets and act before access is abused.

Q: Why do ephemeral cloud assets create attack surface blind spots?

A: Ephemeral cloud assets create attack surface blind spots because they appear and disappear faster than inventory, logging, and scanning tools update. Short-lived workloads, containers, temporary IPs, and autoscaled instances can expose services, secrets, or management endpoints before defenders assign ownership, apply tags, or enforce policy.

Q: How do DNS and certificates help find hidden cloud assets?

A: DNS and certificates help find hidden cloud assets by exposing names, endpoints, and trust relationships that asset inventories miss. DNS records and certificates can reveal subdomains, hostnames, load balancer targets, and service names, while certificate transparency and expiry data often show externally reachable systems that are not tracked in configuration management.

Q: What happens when cloud exposures stay unowned after discovery?

A: When cloud exposures stay unowned after discovery, nobody remediates the exposed service, rotates any leaked secrets, or closes the misconfiguration. The asset may remain publicly reachable, out of policy, and outside patching, logging, or access review, which leaves the exposure active until someone is assigned clear operational ownership.

Technical breakdown

Why point-in-time scanning decays in cloud estates

A point-in-time scan captures exposure only at the moment it runs. In cloud estates, that snapshot loses value quickly because assets are created, changed and destroyed continuously through CI/CD, infrastructure as code and self-service provisioning. Ephemeral containers, serverless functions and short-lived virtual machines may never exist long enough to be inventoried. Security groups, storage permissions and DNS records can also change between assessments, so the asset picture becomes stale even when the scan itself was technically correct.

Practical implication: Treat scheduled scans as a baseline, not as a control that can independently prove current exposure.

How external discovery finds ghost assets

External discovery starts from the attacker's perspective rather than from an internal inventory. That means enumerating DNS records, certificates, IP ranges, cloud provider footprints and other internet-visible indicators to surface assets that were never documented centrally. This approach matters because decentralized ownership creates shadow cloud accounts and transient services that internal tooling may not know exist. The result is not just better inventory, but a more realistic picture of what is actually reachable from outside the organisation. See the OSINT and Reconnaissance Guide.

Practical implication: Use attacker-oriented discovery to identify externally reachable assets that your CMDB or cloud inventory has not yet absorbed.

Why ownership and workflow determine whether visibility matters

Discovery is only useful if findings move into remediation with clear ownership. Cloud exposure often spans infrastructure, application and business teams, so an unassigned asset can remain open even after it is found. Operationally, the challenge is routing each exposure to the team that can close it and proving the closure happened. Without that workflow, organisations accumulate alerts but do not reduce risk. See the Attack Surface Management Maturity Model.

Practical implication: Assign exposure ownership at the time of detection and track remediation to closure, not to notification.

Threat narrative

Attacker objective: The objective is to exploit unmonitored internet-facing cloud assets before defenders discover them and close the exposure window.

1. Entry occurs when a new cloud asset, subdomain or storage service is exposed between scheduled scans and is therefore available for reconnaissance before defenders notice it.
2. Credential or configuration abuse follows when misconfigured permissions, open ports or weakly governed cloud settings let an attacker interact with the asset as if it were intended to be public.
3. Impact occurs when the exposed system is used for persistence, data access or further compromise while the organisation is still waiting for the next assessment cycle.

Breaches seen in the wild

• Firebase misconfiguration exposure 2024: Missing Firebase security rules on 916 websites exposed 125 million user records and 19.87 million plaintext passwords; a quarter were fixed.
• Codefinger S3 ransomware 2025: Codefinger used victims' compromised AWS keys to re-encrypt S3 buckets with SSE-C, set 7-day deletion and demanded ransom for the key.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Continuous discovery is now a governance requirement, not a tooling preference. Cloud environments change faster than quarterly review cycles, so point-in-time asset visibility no longer matches operational reality. The control failure is not merely incomplete inventory but stale governance over systems that can be created, changed and exposed between assessments. Practitioners should treat exposure freshness as a security objective in its own right.

External attack surface management is becoming the practical bridge between cloud operations and security governance. Cloud teams can deploy assets in minutes, but risk ownership still depends on knowing what is live, reachable and misconfigured. That creates a governance gap when discovery data does not flow into remediation fast enough. The organisations that will manage this best are the ones that make exposure ownership explicit across infrastructure and application teams, not the ones that rely on periodic reporting.

Shadow cloud assets are a visibility problem before they are a threat problem. The dangerous condition is not just malicious exploitation but unmanaged reachability, especially when business units or subsidiaries create their own cloud footprints. That is where continuous discovery changes the security conversation from inventory completeness to response readiness. Attack surface management becomes the control that decides whether unknown exposure sits for days or gets handled while it is still small.

Exposure freshness is the named concept this market now has to manage. The central risk is the delay between an asset becoming internet-reachable and the organisation learning about it. In cloud estates, that delay is enough for attackers to find and weaponize the asset before the next scheduled scan. Practitioners should measure discovery latency as seriously as they measure mean time to remediate.

From our research library:

• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: Attack Surface Management Maturity Model

What this signals

Exposure freshness is becoming the metric that separates mature programmes from merely well-instrumented ones. Quarterly reporting can still look disciplined while leaving newly created assets untracked for weeks. The practical shift is toward measuring how quickly external discovery reflects real cloud change, not how polished the last inventory looked.

Cloud sprawl will keep exposing a gap between ownership and observability. Self-service provisioning and subsidiary cloud accounts create assets faster than most governance workflows can absorb them. Security teams that cannot bind new exposure to an owner inside the same operational cycle will keep losing time to drift.

Developer behaviour remains part of the exposure problem. Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap according to the State of Secrets in AppSec. That gap turns cloud change into a control problem because new assets are often created with weak secret hygiene, not just weak visibility.

For practitioners

• Shift from periodic scans to continuous external discovery Run external discovery on a cadence that matches cloud change, with alerts for new hosts, subdomains, certificates, open ports and storage exposure as they appear.
• Map every exposure to an owning team Require each newly exposed asset to have an accountable remediation owner, a target closure date and a verified resolution path before it is considered accepted risk.
• Prioritise internet-facing assets with active exploit interest Rank exposures by attacker relevance, not by raw count, so the team fixes the services most likely to be probed first.
• Validate cloud exposure from the outside in Compare internal inventory with external visibility checks so shadow accounts, misconfigured buckets and drifted DNS records are found before they become persistent blind spots.

Key takeaways

• Quarterly cloud scanning leaves organisations exposed to assets that can appear and change long before the next review window.
• The evidence points to a widening visibility gap, with federal guidance now expecting weekly discovery and threat actors moving far faster than periodic assessments.
• Continuous attack surface management matters because discovery, ownership and remediation now have to operate on cloud time, not audit time.

Related NHI Mgmt Group resources: Attack Surface Management Guide · OSINT and Reconnaissance Guide · Cloud Misconfiguration Guide · Firebase misconfiguration exposure 2024 · Codefinger S3 ransomware 2025

Key terms

• Attack Surface Management: Attack surface management is the practice of finding and evaluating assets that could be exposed to misuse or compromise. CAASM focuses on internal visibility across the environment, while EASM focuses on externally reachable assets. It is a discovery discipline, not a complete identity control model.
• Configuration Drift: Configuration drift is the gradual divergence between a system's intended secure state and the settings it actually runs with over time. In SaaS, drift often appears when admins change sharing, logging, or access controls under pressure and never return to validate the result.
• Ephemeral Assets: Ephemeral assets are systems or resources that exist only for a short time and are then replaced, reimaged, or decommissioned. In cloud environments, they are created through automation and scale rapidly. Security controls must assume short lifespans, because manual management leaves stale exposure behind.
• External Attack Surface: External attack surface is the set of internet-facing assets, services, and identities that outsiders can reach and target. In security practice, it includes exposed domains, cloud endpoints, APIs, remote access paths, and misconfigured secrets or identities that expand opportunity for reconnaissance, exploitation, and initial compromise.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management and workload identity. It gives practitioners the vocabulary and control patterns needed to govern access in modern environments.