Attack surface exposure: are your internet-facing assets still acceptable?

TL;DR: 60% of organisations have at least one exposed HTTP panel, one in four have an exposed MySQL database, and midmarket teams can take up to 56 days to remove issues after discovery, while AI is shrinking time-to-exploit to a single day, according to Intruder. The operational gap is no longer discovery, but how quickly organisations can reduce exposure before public vulnerabilities become reachable attack paths.

NHIMG editorial — based on content published by Intruder: issue #7 of The Vulnerabulletin and the 2026 ASM Index findings

By the numbers:

• 60% of organizations have at least one HTTP panel exposed.
• 1 in 4 organizations have a MySQL database exposed.

Questions worth separating out

Q: What breaks when internet-facing admin panels are left exposed?

A: Exposed admin panels reduce the distance between scanning and compromise.

Q: Why do exposed databases and file shares create identity risk?

A: Because they often contain secrets, tokens, and session material that let attackers bypass normal login flows.

Q: How do security teams know if an exposure programme is actually working?

A: Look for fewer verified attack paths, not just fewer alerts.

Practitioner guidance

• Map every public-facing service to an owner and identity path Build a live register of internet-facing panels, databases, and APIs, then tie each one to an accountable owner, authentication method, and privileged identity path.
• Remove unauthorised administrative exposure first Prioritise closure of exposed HTTP panels, database endpoints, and remote admin interfaces before low-risk hygiene work, because these surfaces create the shortest path to compromise.
• Shorten exposure remediation workflows Set explicit service-level targets for exposure removal, route high-risk findings into incident-style triage, and escalate unresolved issues that exceed your accepted closure window.

What's in the full article

Intruder's full article covers the operational detail this post intentionally leaves for the source:

• The full 2026 ASM Index with the top 10 exposed asset types and benchmark breakdowns by industry and company size
• The vendor's methodology for analysing 3,000 attack surfaces and identifying exposure patterns
• The AI pentesting detail behind the scanning and pentest gap, including the issue types uncovered
• The discussion from Techstrong TV on how AI is reshaping attack surface management in practice

👉 Read Intruder's 2026 ASM Index on exposed attack surfaces and remediation lag →

Attack surface exposure: are your internet-facing assets still acceptable?

Explore further

View Full Forum →  |  NHI Foundation Course →