Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: Attack surface management is shifting from vulnerability tracking to change governance, because internal changes like new assets, API updates and policy drift can open faster exploit windows than public CVEs, according to CYCOGNITO’s analysis. The practical challenge is not discovery alone, but continuous validation, context-aware prioritisation and confirmed remediation.
NHIMG editorial — based on content published by CYCOGNITO: the role of attack surface management in a world of rapid change
By the numbers:
- The size of an organization’s attack surface can fluctuate by as much as 10% in a single month.
- 59% of respondents in the 2025 SANS ASM Survey named daily as their preferred scan frequency.
- Roughly 25% of issues marked resolved still leave the underlying risk wide open.
Questions worth separating out
Q: How should security teams validate attack surface changes in fast-moving environments?
A: They should tie validation to change events, not fixed intervals.
Q: Why does rapid infrastructure change create more security risk?
A: Rapid change shortens the time between something going live and someone exploiting it, especially when internal teams can create new services or modify access paths without strong guardrails.
Q: What are the signs that an ASM programme is too noisy?
A: A noisy ASM programme produces many alerts from churn that turn out to be harmless, such as dynamic IP changes, shifting infrastructure or duplicate findings caused by stale context.
Practitioner guidance
- Define change as a security control input Track new assets, changed policies, shifted endpoints and connected services as first-class security events, not just operations metadata.
- Align discovery cadence to actual environment churn Test whether your current scan frequency matches the rate at which production changes happen.
- Add stack context before escalating findings Require reachability, authentication state, compensating controls and exposed version data before routing issues to owners.
What's in the full article
CYCOGNITO's full article covers the operational detail this post intentionally leaves for the source:
- The five-pillar ASM operating model, including how structural discovery and rapid run frequency fit together.
- The change-aware prioritisation logic used to rank assets when internal and external conditions move at the same time.
- The remediation validation loop that checks whether a fix truly removed the risk in the target environment.
- The practical interpretation of what ‘continuous’ scanning means when assets and exposures change daily.
👉 Read CYCOGNITO's analysis of attack surface management as change governance →
Attack surface change: what it means for security teams?
Explore further
02/09/2026 1:30 pm
ASM is becoming a governance layer for change, not just a scanner for exposure. The article’s core point is that modern attack surfaces are shaped by internal change as much as external vulnerability. That shifts ASM closer to continuous governance, because teams now need to know what changed, why it matters, and which trust relationships were affected. For identity and access programmes, the lesson is that governance must extend beyond accounts and entitlements into the systems and services those identities can reach.
A question worth separating out:
Q: How do teams know whether a finding is actually fixed?
A: They should re-test the issue in the relevant environment and confirm the risk no longer reproduces. Ticket closure alone is not evidence, because fixes can be partial, applied in the wrong place or fail to remove the underlying exposure. Verified remediation means the condition is gone, not just acknowledged.
👉 Read our full editorial: Attack surface management is becoming a change governance problem
