Topic starter
18/08/2026 2:50 pm
TL;DR: 60% of organisations have at least one exposed HTTP panel, one in four have an exposed MySQL database, and midmarket teams can take up to 56 days to remove issues after discovery, while AI is shrinking time-to-exploit to a single day, according to Intruder. The operational gap is no longer discovery, but how quickly organisations can reduce exposure before public vulnerabilities become reachable attack paths.
Editorial analysis by NHI Mgmt Group, based on content published by Intruder: “The Vulnerabulletin Issue #7”.
Key questions
Q: What should teams do when new internet-facing assets appear that have not yet been tested?
A: Teams should import the new assets into the testing workflow, apply filters and tags to prioritise the most important exposures, and queue them for safe validation.
Q: Why do internet-facing services increase vulnerability risk so quickly?
A: Because attackers can probe them immediately once disclosure happens, and many serious vulnerabilities move from public notice to exploitation in 24 to 48 hours.
Q: What signs show that attack surface visibility is failing?
A: Common warning signs include unknown service accounts, stale OAuth grants, overpermissioned cloud roles, shadow IT assets, and gaps between asset inventory tools.
Practitioner guidance
- Inventory and classify all internet-facing assets Build a current list of externally reachable panels, databases, management ports and APIs, then assign an owner and business purpose to each.
- Reduce exposure before remediation queues form Remove unnecessary public reachability first, then fix the underlying vulnerability or misconfiguration so the asset is not defensible only in theory.
- Set exposure SLAs alongside patch SLAs Track how long each issue remains publicly reachable after discovery, and escalate assets that exceed your accepted remediation window.
Bottom line: Internet-facing assets become instant targets when exposure is broader than the business need and remediation is slower than attacker discovery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:32 pm
Internet exposure has become a governance failure, not just a configuration issue. The article's core message is that public reachability now determines how quickly a weakness becomes operational. That means asset ownership, approval, and review cycles matter as much as the technical fix. Practitioners should treat externally reachable services as governed exceptions, not accidental leftovers.
A question worth separating out:
Q: How should security teams govern exposed assets without slowing delivery?
A: Use an exception model with ownership, expiry, and review dates. Development teams can still ship quickly, but every externally reachable service should have a documented business need, a bounded exposure period and a named approver responsible for closure or risk acceptance.
👉 Read our full editorial: Attack surface exposure is turning internet-facing assets into instant targets