What Is Attack Surface Management?
Your attack surface is everything an attacker could interact with: domains, subdomains, IP addresses, APIs, cloud services, exposed files and third-party integrations. Attack surface management (ASM) is the continuous process of discovering, inventorying, assessing and monitoring all of it.
Why it matters
Attackers do not limit themselves to your main application. They look for the weakest point: an old staging server, a forgotten marketing site on an outdated CMS, a test database opened to the internet, or a subdomain pointing to a deleted cloud resource. Organisations routinely discover assets they did not know they had.
What an attack surface includes
- Domains and subdomains, including those created by marketing, partners and acquisitions.
- IP addresses and open services across cloud accounts and hosting providers.
- Web applications and APIs, including undocumented and old versions.
- Cloud storage and services reachable from the internet.
- Certificates, which reveal hostnames through public logs.
- Code repositories and packages that may expose secrets.
- Third-party services configured with your domain, such as helpdesks and status pages.
- Leaked credentials and keys associated with your organisation.
The ASM process
- Discover: find assets using DNS enumeration, certificate transparency, IP ranges, search engines, crawling and cloud APIs.
- Inventory: record each asset with its owner, purpose and environment.
- Assess: test assets for vulnerabilities, misconfigurations and exposures.
- Prioritise: focus on exploitable issues on important or sensitive assets.
- Remediate: fix, decommission or restrict.
- Monitor: repeat continuously, since the surface changes daily.
External vs internal ASM
External ASM takes the attacker's view: what is visible and reachable from the internet. Cyber asset attack surface management inventories assets from inside, using cloud and IT APIs. The external view is often where surprises appear, because it shows what you missed.
Common discoveries
| Discovery | Risk |
|---|---|
| Forgotten staging or test environments | Weaker security, real data |
| Dangling DNS records | Subdomain takeover |
| Outdated CMS or software | Known exploits |
| Exposed admin panels and databases | Direct compromise |
Exposed .env or .git files | Credential and code leaks |
| Expired or misconfigured certificates | Trust and interception issues |
Starting small
- List your known domains and cloud accounts.
- Enumerate subdomains through certificate transparency and DNS.
- Scan the resulting hosts for open ports and web services.
- Check each web service for exposed files, outdated software and missing protections.
- Decommission anything nobody owns.
- Automate the process to run continuously.
Attack surface management with SecurityInfinity
SecurityInfinity's recon agent continuously maps your attack surface, discovering subdomains, services, APIs and exposed files, and its brand intelligence looks for leaked keys tied to your organisation. Findings feed straight into testing by the web, API and network agents. Start free.
Frequently asked questions
How is ASM different from vulnerability scanning?
Vulnerability scanning tests known assets. ASM first discovers the assets, including unknown ones, then assesses them continuously.
How often does an attack surface change?
Often daily in active companies, as new services launch, DNS records change and cloud resources are created.
Who should own attack surface management?
Usually security or platform engineering, with each discovered asset assigned to a responsible team.