Notifications
Clear all
Topic starter
18/08/2026 2:50 pm
TL;DR: 60% of organisations have at least one exposed HTTP panel, one in four have an exposed MySQL database, and midmarket teams can take up to 56 days to remove issues after discovery, while AI is shrinking time-to-exploit to a single day, according to Intruder. The operational gap is no longer discovery, but how quickly organisations can reduce exposure before public vulnerabilities become reachable attack paths.
NHIMG editorial — based on content published by Intruder: issue #7 of The Vulnerabulletin and the 2026 ASM Index findings
By the numbers:
- 60% of organizations have at least one HTTP panel exposed.
- 1 in 4 organizations have a MySQL database exposed.
Questions worth separating out
Q: What breaks when internet-facing admin panels are left exposed?
A: Exposed admin panels reduce the distance between scanning and compromise.
Q: Why do exposed databases and file shares create identity risk?
A: Because they often contain secrets, tokens, and session material that let attackers bypass normal login flows.
Q: How do security teams know if an exposure programme is actually working?
A: Look for fewer verified attack paths, not just fewer alerts.
Practitioner guidance
- Map every public-facing service to an owner and identity path Build a live register of internet-facing panels, databases, and APIs, then tie each one to an accountable owner, authentication method, and privileged identity path.
- Remove unauthorised administrative exposure first Prioritise closure of exposed HTTP panels, database endpoints, and remote admin interfaces before low-risk hygiene work, because these surfaces create the shortest path to compromise.
- Shorten exposure remediation workflows Set explicit service-level targets for exposure removal, route high-risk findings into incident-style triage, and escalate unresolved issues that exceed your accepted closure window.
What's in the full article
Intruder's full article covers the operational detail this post intentionally leaves for the source:
- The full 2026 ASM Index with the top 10 exposed asset types and benchmark breakdowns by industry and company size
- The vendor's methodology for analysing 3,000 attack surfaces and identifying exposure patterns
- The AI pentesting detail behind the scanning and pentest gap, including the issue types uncovered
- The discussion from Techstrong TV on how AI is reshaping attack surface management in practice
👉 Read Intruder's 2026 ASM Index on exposed attack surfaces and remediation lag →
Attack surface exposure: are your internet-facing assets still acceptable?
Explore further
18/08/2026 3:32 pm
Attack surface is now an identity problem as much as an exposure problem. Exposed panels and databases rarely matter in isolation. They matter because they often front credentials, service accounts, or administrative sessions that can be abused once reachable from the internet. That is why NHI governance belongs in attack surface management conversations. If a public asset can reveal or activate a privileged identity, the exposure has already crossed from infrastructure hygiene into identity risk. Practitioners should map every externally reachable system to the identities it can authenticate, mint, or leak.
A question worth separating out:
Q: Who is accountable when a public service leads to compromise?
A: Accountability should sit with the asset owner, the platform team responsible for reachability, and the security function that defines closure standards. If identity material such as secrets or service accounts is involved, IAM or NHI governance teams should also own the revocation and rotation response. Shared exposure needs named ownership, not a generic security queue.
👉 Read our full editorial: Attack surface exposure is turning internet-facing assets into instant targets
