Topic starter
19/08/2026 3:34 pm
TL;DR: Security teams are losing to the asset they never saw, as Xygeni argues that attack surface discovery is now the foundational control for closing the gap between what organisations think they run and what is actually exposed. The issue spans shadow IT, APIs, AI agents, and supply chain dependencies, where blind spots create the conditions for credential abuse, vulnerability exploitation, and fast-moving incidents.
Editorial analysis by NHI Mgmt Group, based on content published by Xygeni: “Security Threats in 2026: Types, Blind Spots, and Why Attack Surface Discovery Is the Fix”.
Key questions
Q: What breaks when IAM teams cannot see the full attack surface?
A: Governance breaks first, because teams can only certify and remediate what they can inventory.
Q: Why do unknown assets create more risk than ordinary findings?
A: Unknown assets are dangerous because defenders cannot assign ownership, evaluate criticality, or confirm whether an access path is still live.
Q: What do security teams get wrong about attack surface management?
A: Teams often treat ASM as a scanning activity when it is really an operating model for continuous exposure control.
Practitioner guidance
- Continuously discover unmanaged assets Run discovery across cloud, SaaS, code, runtime, and integration layers so new assets are identified as they appear, not at the next quarterly review.
- Reconcile service accounts to owners Require every discovered service account, token, and automation identity to map to a named business or engineering owner with a reviewable lifecycle.
- Fold APIs and AI agents into one inventory Treat undocumented APIs, agent workflows, and machine-to-machine traffic as governed assets that belong in the same inventory and risk model as servers.
Bottom line: Modern attack surface management fails when organisations do not know which assets, identities, and dependencies actually exist.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:15 pm
Attack surface discovery is now a governance control, not a reconnaissance add-on. The article shows that the real failure is no longer detection alone, but not knowing what should be detected in the first place. That changes the control objective from periodic inventory to continuous asset discovery across cloud, application, identity, and pipeline layers. Practitioners should treat discovery as the front end of exposure management, not a reporting output.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How should teams govern AI agents and APIs in the same exposure model?
A: They should inventory them as live assets with explicit ownership, approved use cases, and access scope, then monitor them continuously for changes in reachability and trust. AI agents, undocumented APIs, and M2M traffic can all expand the attack surface faster than manual review cycles, so governance has to move into the discovery layer.
👉 Read our full editorial: Attack surface discovery is becoming core to modern threat defence