Notifications
Clear all
Topic starter
18/08/2026 2:34 pm
TL;DR: 60% of organisations had at least one exposed HTTP panel, and remediation in midmarket firms peaked at 56 days, leaving internet-facing assets exposed long enough to be discovered and abused, according to Intruder’s 2026 Attack Surface Management Index based on 3,000 attack surfaces. Patching alone is insufficient when exposure is the real root cause, and identity, access, and service hardening must move earlier in the control chain.
NHIMG editorial — based on content published by Intruder: 2026 Attack Surface Management Index
By the numbers:
- 60% of organisations had at least one HTTP panel exposed.
- 49% of organisations exposed a risky port or service.
- 42% of organisations had an exposed database.
Questions worth separating out
Q: How should security teams reduce risk from exposed internet-facing admin panels?
A: Start by identifying every externally reachable management interface, then remove public access unless there is a documented business need.
Q: Why do exposed databases and file shares create identity risk?
A: Because they often contain secrets, tokens, and session material that let attackers bypass normal login flows.
Q: What breaks when patching is the only response to exposure?
A: Patch-only programmes leave the underlying reachability problem untouched, so attackers can still discover and target the asset while remediation is queued.
Practitioner guidance
- Map every internet-facing management surface Create a live inventory of HTTP panels, RDP, databases, and admin tools that are reachable from the public internet, then assign ownership for each one.
- Remove public reachability before patching When a service is externally reachable without a strong business requirement, take it off the internet first and then patch or harden it.
- Treat exposed databases as secret leakage risks Check exposed databases and admin consoles for API keys, session tokens, service account credentials, and configuration exports.
What's in the full report
Intruder's full index covers the operational detail this post intentionally leaves for the source:
- Per-exposure remediation benchmarks across organisation size bands, useful for comparing your own removal timelines.
- The ranked list of the top 10 exposed asset types, including MySQL, Postgres, RDP, and WordPress admin panels.
- The methodology behind the 3,000 attack surface sample and how Intruder classified exposure categories.
- The report’s benchmark data on growth-stage exposure differences, which helps teams justify headcount and tooling changes.
👉 Read Intruder's 2026 Attack Surface Management Index on exposed panels, services, and databases →
Attack surface exposure trends: what IAM and security teams should act on?
Explore further
18/08/2026 3:20 pm
Exposure governance is now a first-order identity control problem. The report shows that the risk begins before authentication, not after it. When panels, databases, and service interfaces are public, identity controls inherit a larger attack surface and weaker assumptions about who can even reach the asset. Practitioners should treat reachability as part of identity governance, not as a separate infrastructure issue.
A few things that frame the scale:
- Strongly related exposure patterns are visible in our research: 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to The State of Secrets Sprawl 2026.
- Our research also found that 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, showing how new tooling can create fresh identity leakage paths.
A question worth separating out:
Q: Who is accountable when a service account breach exposes customer data?
A: Accountability sits with the team that owns the application, the identity lifecycle, and the control environment around the service account. If no owner can explain why the credential existed, how it was rotated, and what it could access, governance has failed. Frameworks such as OWASP-NHI and NIST CSF both point to clear ownership and recoverability.
👉 Read our full editorial: Attack surface exposure is outrunning patch-first security models
