Attack surface management matures in four stages: a manual list, regular discovery, owner linked findings, and continuous change driven response. Each stage is defined by what you can answer, not which tool you own. The test at every stage is whether a new exposed asset gets found, assigned and handled without heroics.
Stage 1: The list
You keep a spreadsheet of domains, cloud accounts and key applications, updated when someone remembers. Discovery happens by accident: a bill arrives, a certificate expires, a customer reports a strange page.
You can answer: "What are our main systems?" You cannot answer: "What went public this week?"
Move up by: exporting DNS zones, cloud account lists and repository lists into one place, with a date.
Stage 2: Regular discovery
A scheduled process, automated or manual, compares what exists against the list. New domains and public services appear in a report. The report lands in a shared channel, and some items get fixed.
You can answer: "What is new since last month?" You cannot answer: "Whose is it?"
Move up by: adding an owner field and a rule that a finding without an owner is escalated, not parked.
Stage 3: Owner linked
Every asset has an owner drawn from a real source: cloud tags, repository ownership, a service catalog. Findings route to that owner with a priority. Triage rules exist, such as exposure plus known exploitation first. Public inputs help: the CISA Known Exploited Vulnerabilities catalog and FIRST EPSS probabilities.
You can answer: "Who fixes this, and by when?" You cannot answer: "Which exposures matter for our business?" in a data driven way.
Move up by: adding business context (data held, revenue dependency) and validation, meaning checking whether an exposure is truly reachable.
Stage 4: Continuous and change driven
Discovery is triggered by change: a deploy, a new DNS record, a new integration, an acquisition. Priorities combine exposure, exploitation signals and business impact. Unowned assets expire by default. Metrics are reviewed monthly by an engineering leader, not only by security.
You can answer: "What changed, who owns it, and is it being handled?" in minutes.
A constructed walkthrough
A marketing team spins up a campaign site on a new subdomain. At stage 1 nobody in security knows until it breaks. At stage 2 it appears in the next monthly report. At stage 3 the report names the marketing owner and a ticket opens. At stage 4 the DNS change itself triggers a check, the owner is prompted to confirm purpose and end date, and the site is removed after the campaign without anyone chasing.
What does not indicate maturity
- The number of assets discovered.
- Dashboard polish.
- Alert counts.
- A long tool list.
What does indicate it: owner coverage, time from appearance to owner assigned, time from owner assigned to closure, and the count of assets that came back after removal.
A scope note
Safeguard covers application and software supply chain exposure, such as dependencies and code. It also offers asset discovery with guardrails on discovered assets. It does not claim to be a full external attack surface product, so use it as part of a broader program.
How do you move faster between stages?
Most of the effort at every stage is organizational, not technical. Three habits speed things up.
Pick a narrow scope first. Run the whole model on one business unit or one cloud account, learn what breaks, then widen. A pilot that covers everything usually finishes nothing.
Reuse systems people already trust. If engineers already update a service catalog, make that the owner source rather than inventing a new register nobody maintains.
Publish the numbers. A simple monthly chart of owner coverage and time to closure, shared with engineering managers, creates healthy pressure without a single escalation email. When a team sees itself at the bottom of a list, it often fixes the cause quickly, whether that was a missing tag or a forgotten test environment.
Expect regressions. Reorganizations, acquisitions and new cloud accounts push you back a stage in some areas. That is normal, and the assessment is meant to be repeated.
What to do
- Place yourself at one of the four stages using the "can answer" lines.
- Pick one "move up" action and finish it this quarter.
- Define owner coverage and measure it now.
- Write the unowned asset policy.
- Re-assess in six months.
Quick check
How do I know I have reached stage 3?
Every discovered asset has a named owner from a real data source, and findings reach that owner without manual lookup.
Do I need all four stages?
No. A small company may be well served at stage 3. Move on when the cost of surprises justifies it.
Sources
Last reviewed: 18 October 2026.
