<img src="https://certify.alexametrics.com/atrk.gif?account=kla4t1zDGU20kU" style="display:none" height="1" width="1" alt="">
Contact us
Request demo →
Contact us
German website

What does effective attack surface management look like?

by Vincent Thiele Blog 10 Jun 2021

In recent blog posts we’ve discussed the need to understand how your attack surface affects your risk and highlighted three areas that regularly slip under the radar when trying to analyse the true extent of that attack surface. The answer to both these challenges is attack surface management, and in this blog we’re going to focus on what that looks like.

Effective attack surface management breaks down into four key parts:

  • Discovery
  • Assessment and prioritisation
  • Risk prevention
  • Integration


The most important part of any attack surface management process is the discovery phase. As we’ve mentioned previously, most organisations miss as much as 30 to 50 percent of their true attack surface. This creates huge blind spots when it comes to understanding the real risks your organisation is facing. In fact, we believe that something like 80% of all organisations’ cybersecurity problems exist due to blind spots in their attack surface. Eliminating those blind spots should be your core goal when setting out to discover your attack surface.

One of the biggest contributing factors to these blind spots is scoping. Organisations tend to work within a predefined scope when it comes to discovery – whether that’s within a defined IT infrastructure or a set of IP addresses that the organisation uses and wants to protect.

However, the reality is that any would-be attackers out there do not care about your scope. Whether you have a vulnerability in-house, via an external supplier, or in a cloud environment; an attacker will find it and try to misuse it.

On top of this, with modern organisations having so many external dependencies, regulatory bodies are starting to insist that financial services companies look beyond the boundaries of their own networks when analysing risk.

For example, the Digital Operational Resilience of the financial sector (DORA), extends the focus of risk management to cover all external assets of the parties they have relationships with (such as fourth and fifth parties, or parties that you even don't know you have a relationship with), as well as any services and infrastructure that can impact on the organisation’s day-to-day resilience.

Taking a zero-scope approach to your attack surface is therefore essential. This means that tracking down the full extent of your attack surface is not something that can be left to human endeavour. Relying on people to trace and discover your connections would be hugely expensive, time consuming, and error prone. So, a prerequisite of effective discovery is automation. AI and algorithmic-based discovery is the only way to uncover the bulk of your attack surface.

Tackling the Exponential Growth of the Attack Surface - smallBanner

Assessment and prioritisation

Monitoring your attack surface is not a one-time, set-and-forget process because your attack surface is not static; it’s constantly evolving and changing. This means you need to be continuously monitoring it for changes, and you need to be alerted when those changes occur, so that you can decide whether or not something needs your attention. This data needs to be dynamic and as close to real-time as you can get.

Only once you know what your full attack surface looks like can you really start to analyse the risk types presented to the business. These risks can be extensive and need prioritisation according to the threat presented to the brand. As the discovery process continues, you need an automated risk assessment tool to save time and effort. It will tell you what the most pressing risks are, so you can focus on the mitigating process. Then, even when the discovery process is ongoing, new risks are automatically reported on, and added to right lists. This ensures you stay up-to-date on the actual risks to the organisation – removing a lot of the stress from the process for CISOs.

Risk prevention

There is a flipside to seeing your whole attack surface. Having a comprehensive overview of every risk your organisation faces can be terrifying – you are going to uncover a multitude of things you’d never considered. This can leave you facing one big question: “Do I really want to know all of this?”

Most CISOs and cybersecurity professionals are already busy with all the things they do know about, so you need to have a way of striping out and solving some of the possibly lower priority but easier to solve risks in your report. This is again where automation can come into play. Automatically categorising similar risk types throughout your attack surface will save time and effort when reducing risks.


Finally, it doesn’t matter how much data you have on something; if it’s not actionable it’s ultimately not going to be practical to use. So you need to be able to connect all that data coming from your attack surface monitoring into your existing internal processes and systems (your PSA, ITSM, or ESM tools etc). That way you can build it into your existing cybersecurity structure and minimise extra work.

To find how you can easily achieve effective attack surface monitoring for your organisation, download our free whitepaper Tackling the Exponential Growth of the Attack Surface – Why you need to know what you have, where it is, and what it’s doing.Download whitepaper (PDF) →


Securing critical infrastructure: new regulations mandate control

The name itself says it already: organisations in the critical infrastructure are vital in the services they provide in society. Should something go wrong in their daily operations, it can have severe consequences and disrupt individual people and other companies. That doesn’t necessarily mean they are more often targeted in (cyber-)attacks, but it does pose an extra reason to prevent any successful attack. Such organisations have often been in charge of their own cybersecurity, guided by regulations. Now though, authorities in the EU are starting to intensify their watchful eyes with the RCE directive. What is the EU RCE? And how should critical infrastructure organisations prepare?

read more

Mandatory IT audits: risk scores don’t mean security

More organisations in the Netherlands recognise the need for an active approach to stay in control over their attack surfaces in order to mitigate risks. Every organisation is able to create their own IT security governance and processes. Now, though, a new standard might be introduced in the form of an annual, mandatory IT audit. Is this a development helping businesses further? Or one that doesn’t really add anything other than paperwork?

read more

Determining your cybersecurity maturity

How safe your organisation is from a cybersecurity point of view depends on a lot of factors. Not only should your private and confidential data be kept private and confidential through a plethora of technical defenses, there are also, among others, many processes such as for IT governance and incident response to consider. How your organisation deals with all these challenges determines its cybersecurity maturity. But why is determining this maturity level important?

read more

Do you have a question?

Our experts have the answers

Contact us