Topic starter
18/08/2026 2:34 pm
TL;DR: 60% of organisations had at least one exposed HTTP panel, and remediation in midmarket firms peaked at 56 days, leaving internet-facing assets exposed long enough to be discovered and abused, according to Intruder’s 2026 Attack Surface Management Index based on 3,000 attack surfaces. Patching alone is insufficient when exposure is the real root cause, and identity, access, and service hardening must move earlier in the control chain.
Editorial analysis by NHI Mgmt Group, based on content published by Intruder: “2026 ASM Index: the most common attack surface exposures”.
By the numbers:
- 60% of organisations had at least one HTTP panel exposed.
- 49% exposed a risky port or service.
- 42% had an exposed database.
Key questions
Q: What breaks when an internal service is exposed to the internet by mistake?
A: The main failure is that the asset boundary disappears, so attackers can probe authentication, brute-force weak credentials, or exploit any flaw without first defeating perimeter controls.
Q: Why do exposed systems remain risky even after the patch is installed?
A: Because attackers may already have established persistence before remediation completed.
Q: What are the signs that manufacturing attack surface management is failing?
A: Common warning signs include unknown internet-facing assets, delayed remediation of exposed vulnerabilities, inconsistent inventory records across teams, and weak visibility into third-party exposures.
Practitioner guidance
- Tighten internet exposure policy Classify every externally reachable panel, database, and service by business necessity, then remove public access for anything that does not have an explicit external use case.
- Bind IAM review to exposure review Require access owners to validate whether exposed assets depend on static passwords, API keys, or admin logins, and retire any access path that exists only for convenience.
- Prioritise removal over patching When a new flaw appears on a public service, first confirm whether the service should be internet-facing at all, then patch only the assets that still need exposure.
Bottom line: The core risk is not only exploitable software, but exposed services and panels that should never have been internet-facing in the first place.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:20 pm
Exposure control is now a governance control, not just an operations task. The article shows that the core failure is not simply whether a system is patched, but whether it should have been internet-facing at all. That changes the decision boundary for IAM, PAM, and NHI teams because reachability determines how much identity and credential risk exists before an attacker even starts. Practitioners should treat exposure removal as a first-class control objective.
A few things that frame the scale:
- 69% of organisations still authenticate machine identities with long-lived API keys, according to the 2026 State of AI Agent Identity Security Report.
A question worth separating out:
Q: When should organisations prioritise exposure management over traditional vulnerability management?
A: Organisations should prioritise exposure management when the main concern is what attackers can reach from outside, not just what is technically vulnerable inside the estate. It becomes especially important for public-facing services, exposed databases, remote access paths, and fast-changing cloud environments. Exposure management helps teams focus resources on the assets most likely to be attacked successfully.
👉 Read our full editorial: Attack surface exposure is outrunning patch-first security models