Topic starter
11/11/2026 6:00 pm
TL;DR: Cloud sprawl and configuration drift make quarterly scans obsolete, according to Cyble, because new assets can appear and change between assessment windows. External visibility has to move to a continuous model if teams want to see exposed services before attackers do.
Editorial analysis by NHI Mgmt Group, based on content published by Cyble: “Attack Surface Management 2026: Why Point-in-Time Scans Fail”.
By the numbers:
- ENISA's Threat Landscape 2025 found that vulnerability exploitation accounted for 21.3% of initial access in the EU.
Key questions
Q: Why do ephemeral cloud assets create attack surface blind spots?
A: Ephemeral cloud assets create attack surface blind spots because they appear and disappear faster than inventory, logging, and scanning tools update.
Q: How do DNS and certificates help find hidden cloud assets?
A: DNS and certificates help find hidden cloud assets by exposing names, endpoints, and trust relationships that asset inventories miss.
A: Teams should use a cloud-agnostic view that links network exposure, identity permissions, and asset configuration in one model.
Practitioner guidance
- Shift from periodic scans to continuous external discovery Run external discovery on a cadence that matches cloud change, with alerts for new hosts, subdomains, certificates, open ports and storage exposure as they appear.
- Map every exposure to an owning team Require each newly exposed asset to have an accountable remediation owner, a target closure date and a verified resolution path before it is considered accepted risk.
- Prioritise internet-facing assets with active exploit interest Rank exposures by attacker relevance, not by raw count, so the team fixes the services most likely to be probed first.
Bottom line: Quarterly cloud scanning leaves organisations exposed to assets that can appear and change long before the next review window.
Glossary terms: Attack Surface Management, Configuration Drift, Ephemeral Assets, External Attack Surface
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:08 pm
Continuous discovery is now a governance requirement, not a tooling preference. Cloud environments change faster than quarterly review cycles, so point-in-time asset visibility no longer matches operational reality. The control failure is not merely incomplete inventory but stale governance over systems that can be created, changed and exposed between assessments. Practitioners should treat exposure freshness as a security objective in its own right.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: What happens when cloud exposures stay unowned after discovery?
A: When cloud exposures stay unowned after discovery, nobody remediates the exposed service, rotates any leaked secrets, or closes the misconfiguration. The asset may remain publicly reachable, out of policy, and outside patching, logging, or access review, which leaves the exposure active until someone is assigned clear operational ownership.
👉 Read our full editorial: Continuous attack surface management replaces quarterly blind spots