Topic starter
12/02/2026 8:47 pm
TL;DR: A broad attack surface expands entry points across digital, physical, social, AI, and IoT layers, and compromised credentials remain a common initial path, according to StrongDM’s analysis. Reducing exposure only works when IAM, PAM, and Zero Trust controls are applied to the identities and endpoints that actually drive access decisions.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “What is an Attack Surface? (And the Best Way to Reduce It)”.
By the numbers:
- 20% of all cyberattacks start with compromised credentials.
- These breaches can cost upwards of $4.45 million on average and take approximately 287 days to contain.
- 69% of companies have IoT devices that outnumber computers on their network, but only 16% have IoT attack surface visibility.
Key questions
Q: Why does attack surface reduction fail when identity controls are weak?
A: Because the attacker does not need every exposed system if one valid identity can open multiple paths.
Q: What should organisations prioritise first in identity governance?
A: Organisations should prioritise the highest-cost access problems first: orphaned accounts, excessive privilege, and manual review bottlenecks.
Q: What are the signs that an attack surface reduction program is not working?
A: Common warning signs include unmanaged shadow IT, still-open ports, outdated software, excessive permissions, and third-party integrations that are not continuously reviewed.
Practitioner guidance
- Map every exposed entry point to an identity owner Document which human, service, or device identity can reach each externally exposed system, then record how that access is granted, validated, and revoked.
- Review permissions alongside surface inventories Pair asset discovery with entitlement reviews so you can spot endpoints that are technically exposed but reachable by far too many users or services.
- Use PAM to shrink the blast radius of compromise Limit privileged operations to short-lived, tightly scoped access paths so a stolen credential cannot be reused for broad internal movement.
Bottom line: Attack surface reduction is incomplete if identity governance is excluded from the control model, because valid credentials and excessive permissions keep exposure usable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
07/10/2026 9:41 pm
Attack surface reduction fails when identity is treated as downstream of exposure management. The article’s central point is that a smaller technical footprint does not automatically mean lower risk if access paths remain overbroad or poorly governed. In identity terms, the control plane is deciding whether access is possible, so the surface is not truly reduced until permissions, authentication strength, and offboarding are aligned. Practitioners should treat identity governance as part of attack surface design, not as a separate clean-up activity.
A few things that frame the scale:
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: How do Zero Trust and PAM work together in attack surface management?
A: Zero Trust reduces trust in every access request, while PAM reduces what a successful identity can do after entry. Used together, they lower the blast radius of a compromised account. Without PAM, validation still leaves too much authority behind. Without continuous validation, privileged access can still be abused from inside the network.
👉 Read our full editorial: Attack surface reduction still fails without identity controls