Topic starter
19/08/2026 3:52 pm
TL;DR: Annual penetration tests leave long windows of unverified exposure as cloud drift, forgotten assets, and third-party endpoints change the perimeter faster than teams can review it, according to Sprocket Security’s analysis. Continuous attack surface monitoring, validated by human testing, is becoming the practical answer to an environment attackers can map in minutes.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “How to See Your Perimeter the Way Attackers Do”.
By the numbers:
- According to Mandiant's M-Trends 2024 Report, the global median dwell time was 10 days.
Key questions
Q: What breaks when external attack surface validation is not continuous?
A: Without continuous validation, organisations lose sight of newly exposed assets, stale services, and changes in attack paths.
Q: Why does attack surface drift increase breach risk so quickly?
A: Attack surface drift increases risk because internet-facing assets can become visible, reachable, and exploitable long before they are inventoried or reviewed.
Q: What are the signs that external perimeter controls are failing?
A: The warning signs are stale subdomains that still answer, deprecated APIs that remain active, cloud endpoints that have no inventory owner, and management interfaces reachable from the internet with weak or inconsistent authentication.
Practitioner guidance
- Implement continuous external asset discovery Map internet-facing hosts, subdomains, certificates, and services continuously so new exposure is detected when it appears, not at the next annual review.
- Prioritise remediation for newly exposed services Triage forgotten subdomains, admin interfaces, legacy VPNs, and public storage as high-risk because they are the exact asset classes attackers enumerate first.
- Validate perimeter findings with human testing Confirm whether discovered exposure is reachable, exploitable, or chained before assigning severity, because context determines whether a finding is noise or an entry path.
Bottom line: Annual perimeter testing leaves organisations exposed to attack surface drift that can create exploitable gaps between review cycles.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:29 pm
Perimeter visibility has become a governance problem, not a tooling problem. The article shows that most organisations are not failing because they own no scanners, but because they treat exposure as a periodic event instead of a continuously changing state. That shift matters for every control that depends on asset inventory, including identity-related controls at the edge. The practitioner conclusion is that attack surface governance now belongs in the same operational conversation as configuration drift and lifecycle control.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams handle continuous exposure management when environments change daily?
A: Security teams should use continuous validation to supplement scheduled testing, because point-in-time assessments quickly become stale in dynamic environments. The key is to connect discovery, exploit validation, remediation, and retesting in one loop so that changes in credentials, configuration, or access paths are measured as current risk, not historical risk.
👉 Read our full editorial: Continuous attack surface visibility is replacing annual perimeter testing