Notifications
Clear all
Topic starter
19/08/2026 3:34 pm
TL;DR: Security teams are losing to the asset they never saw, as Xygeni argues that attack surface discovery is now the foundational control for closing the gap between what organisations think they run and what is actually exposed. The issue spans shadow IT, APIs, AI agents, and supply chain dependencies, where blind spots create the conditions for credential abuse, vulnerability exploitation, and fast-moving incidents.
NHIMG editorial — based on content published by Xygeni: attack surface discovery as the foundation for closing modern threat blind spots
By the numbers:
- Vulnerability exploitation reached 20% of breaches in 2025, a 34% year-over-year increase, according to Verizon's 2025 DBIR.
- 73% experienced a security incident caused by unknown or unmanaged assets, according to Trend Micro's 2025 research.
- 48.9% of organisations are entirely blind to machine-to-machine traffic and cannot monitor the AI agents already running in their environment, according to Salt Security's 1H 2026 research.
Questions worth separating out
A: Start with continuous enumeration, not periodic scans.
Q: Why do unknown assets create both security and compliance risk?
A: Unknown assets cannot be patched, retired, audited, or assigned confidently.
Q: What do security teams get wrong about governing AI agents?
A: They often treat agents like another automation layer instead of governed non-human actors with their own access paths.
Practitioner guidance
- Establish continuous asset discovery across code, cloud, and runtime Instrument pipelines and runtime environments so new services, APIs, dependencies, and AI agents are detected as they appear, not at audit time.
- Map discovered assets to identities and secrets For each asset, identify the service accounts, tokens, certificates, and permissions it can use or inherit.
- Correlate discovery with exposure and reachability Do not stop at listing assets.
What's in the full article
Xygeni's full article covers the operational detail this post intentionally leaves for the source:
- Concrete examples of how attack surface discovery applies across code, CI/CD, cloud, and runtime assets.
- The article's full breakdown of threat categories, including supply chain, API, AI-layer, and credential abuse patterns.
- Practical distinctions between discovery and management, including how findings should be prioritised and closed.
- The article's discussion of why blind spots grow in SDLC workflows and how that affects remediation timing.
👉 Read Xygeni's analysis of attack surface discovery and modern security threats →
Attack surface discovery and blind spots: what security teams miss?
Explore further
19/08/2026 4:15 pm
Attack surface discovery is now an identity governance control, not just a visibility control. The article is correct that the gap between known and exposed assets is where modern threats thrive, but that gap also includes identities, secrets, and delegated runtime access. Once AI agents, service accounts, and undocumented APIs are treated as first-class assets, discovery becomes the control that makes IAM and NHI governance possible at scale. Practitioners should therefore treat discovery as a prerequisite to access governance, not a separate cyber programme.
A question worth separating out:
Q: Why do IAM and NHI teams need to care about vulnerability discovery?
A: Because vulnerabilities become far more dangerous when they expose credentials, service accounts, or privileged workflows. IAM and NHI teams control who or what can move after a flaw is found, how far it can move, and how quickly access can be revoked. That makes identity governance part of exploit containment.
👉 Read our full editorial: Attack surface discovery is becoming core to modern threat defence
