Topic starter
18/08/2026 2:56 pm
TL;DR: Attack surface management treats every internet-reachable asset as a potential foothold, and Intruder’s 2026 index says 60% of organisations expose HTTP panels, more than a quarter expose MySQL, and 11% leave Remote Desktop open. The lesson for IAM and security teams is that exposure control, not just vulnerability scanning, is now part of identity and access governance.
Editorial analysis by NHI Mgmt Group, based on content published by Intruder: “What is attack surface management?”.
By the numbers:
- 60% of organisations have an exposed HTTP panel.
- 11% of organisations have Remote Desktop exposed to the internet.
Key questions
Q: What breaks when exposed infrastructure is not removed from the internet?
A: When infrastructure stays publicly reachable without a business need, attackers can target login pages, admin consoles and databases directly.
Q: Why does an exposed admin panel increase compromise risk even without a CVE?
A: An exposed admin panel gives attackers a live authentication target.
Q: What are the signs that manufacturing attack surface management is failing?
A: Common warning signs include unknown internet-facing assets, delayed remediation of exposed vulnerabilities, inconsistent inventory records across teams, and weak visibility into third-party exposures.
Practitioner guidance
- Map every internet-facing login surface Inventory admin panels, databases, Remote Desktop, login pages, subdomains and cloud services that are reachable from the internet, then compare them to approved business need.
- Remove unnecessary public reachability Decommission forgotten assets, move administrative interfaces behind private access paths, and close ports or services that do not need external exposure.
- Tie cloud discovery to access review Feed cloud account and service discovery into IAM and PAM reviews so newly exposed services are assessed as soon as they appear, not at the next periodic audit.
Bottom line: Exposed infrastructure is a security problem in its own right, because reachability gives attackers a foothold even when no CVE exists.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:39 pm
Exposure management is becoming an identity governance problem, not just a perimeter problem. When an admin panel, database or remote desktop service is public, the first control issue is who or what can authenticate to it, not whether a scanner finds a CVE. That makes external attack surface a governance domain for IAM and PAM teams as much as for security operations. Practitioners should treat every exposed login surface as part of the governed access estate.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
A: They should do both, but external attack surface management should come first for internet-facing systems. Scanners tell you what is vulnerable; exposure management tells you what an attacker can actually reach. Without that distinction, teams spend time patching assets that are not exposed while missing the systems most likely to be attacked.
👉 Read our full editorial: Attack surface management shows why exposed infrastructure is the real risk