Notifications
Clear all
Topic starter
18/08/2026 2:56 pm
TL;DR: Attack surface management treats every internet-reachable asset as a potential foothold, and Intruder’s 2026 index says 60% of organisations expose HTTP panels, more than a quarter expose MySQL, and 11% leave Remote Desktop open. The lesson for IAM and security teams is that exposure control, not just vulnerability scanning, is now part of identity and access governance.
NHIMG editorial — based on content published by Intruder: LLMjacking and attack surface management analysis
By the numbers:
- 60% of organizations have an exposed HTTP panel, over a quarter have a publicly-facing MySQL database, and 11% have Remote Desktop exposed to the internet.
- 17 minutes., edentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
Q: What breaks when internet-facing admin panels are left exposed?
A: Exposed admin panels reduce the distance between scanning and compromise.
Q: Why do exposed services complicate IAM and PAM governance?
A: Because identity controls only work cleanly when the access boundary is clear.
Q: How do you know if attack surface management is actually working?
A: Look for fewer unknown internet-facing assets, faster detection of newly exposed services, and clearer ownership for public endpoints.
Practitioner guidance
- Map and remove unnecessary public exposure Inventory internet-facing admin panels, databases, remote access services, and login endpoints, then take anything nonessential off the internet before addressing patch backlog.
- Tie exposure discovery to identity and asset lifecycle Link ASM outputs to account ownership, third-party onboarding, offboarding, and service retirement so forgotten assets do not outlive their business purpose.
- Prioritise credential abuse on exposed services Assume exposed interfaces will be probed for password reuse and guessed credentials, and harden them with unique secrets, strong authentication, and network restrictions.
What's in the full article
Intruder's full guide covers the operational detail this post intentionally leaves for the source:
- Continuous monitoring and change-triggered scanning mechanics for internet-facing assets
- How the connector model maps cloud services to exposed IPs, subdomains, and login pages
- Prioritisation logic that ranks exposed services by exploitability and business risk
- Examples of how new high-impact vulnerabilities trigger immediate re-scans
👉 Read Intruder's guide to attack surface management and exposed infrastructure →
Attack surface management and exposed infrastructure: are your controls keeping up?
Explore further
18/08/2026 3:39 pm
Exposure is now an access-control problem, not only a vulnerability problem. If a service is internet-reachable, the security outcome depends on whether it should have been reachable in the first place. That makes attack surface management adjacent to IAM and PAM, because the first control decision is exposure, not patching. For practitioners, the lesson is to treat public reachability as a governance control with ownership and review.
A question worth separating out:
Q: Who is accountable when an exposed asset becomes the entry point for a breach?
A: Accountability should sit with the team that owns the asset and the control function that governs its exposure, which often includes cloud, application, and identity owners together. In practice, frameworks like the NIST Cybersecurity Framework and NHI governance expect clear ownership, because unresolved exposure is a governance failure as much as a technical one.
👉 Read our full editorial: Attack surface management shows why exposed infrastructure is the real risk
