Topic starter
24/10/2026 8:52 pm
TL;DR: Exploitability now matters more than inventory in expanding attack surfaces, according to Infoblox. Exposure programmes need a way to rank reachability, business context and ownership so remediation cuts attack paths instead of just adding findings.
Editorial analysis by NHI Mgmt Group, based on content published by Infoblox: “Securing the Expanding Attack Surface in the Age of AI”.
By the numbers:
- Infoblox based the report on interviews with over 550 cybersecurity professionals.
Key questions
Q: Why do cloud and SaaS identity paths increase exposure risk so quickly?
A: Because access scope, trust relationships, and configuration drift can combine into a routable attack path in minutes or hours.
Q: How can security teams tell whether a fix actually reduced exposure?
A: They should test whether the original attack outcome can still be reproduced after remediation.
Q: What breaks when exposure management only measures visibility instead of risk reduction?
A: Teams end up with more findings but no better decision-making.
Practitioner guidance
- Prioritise exploitable exposures first Rank exposed assets by reachability, privilege and business criticality, then remediate the items that can be used immediately rather than the loudest findings.
- Govern delegated access paths Inventory SaaS, cloud and AI integrations that rely on tokens, webhooks, service accounts or other non-human credentials, and assign owners for lifecycle review.
- Constrain externally reachable identities Reduce standing privilege and remove unused tokens or accounts that create internet-facing paths into internal systems, especially where services interconnect across domains.
Bottom line: AI-driven threat activity is forcing exposure management to move beyond inventory and toward exploitability.
Glossary terms: Exposure management, Attack Surface Management, Verified Exploitability, Delegated Access
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Visibility is not governance: the market keeps treating exposure discovery as if it were the same thing as risk reduction. It is not. Discovery identifies what exists, but governance determines which exposed assets, identities and integrations are actually exploitable and who is accountable for fixing them. Practitioners should treat exposure programmes as decision systems, not scanning exercises.
A question worth separating out:
Q: Should organisations treat AI systems like part of the attack surface or just another application?
A: They should treat AI systems as part of the attack surface whenever those systems have tokens, delegated access or connections to internal data and workflows. The governance question is not the model alone, but the identities and integrations that let it act on the environment.
👉 Read our full editorial: AI-driven exposure outpaces visibility in expanding attack surfaces
This post was modified 6 days ago by NHI Mgmt Group