A small team can start attack surface management in 90 days by building one trusted asset list, assigning an owner to every item, and fixing the few exposures that matter most. Skip tooling debates for the first month. Inventory and ownership come first, and they cost time rather than money.
What is the attack surface?
It is every place an outsider, or a compromised insider, could interact with your systems: websites, APIs, login pages, mail, cloud storage, remote access, code repositories, third party integrations. It grows when teams launch things quickly and shrinks only when someone deliberately retires them.
Days 1 to 30: see it
Start with the ground you already know. Pull domains from your registrar and DNS provider, cloud accounts from finance records (the billing statements show accounts nobody remembers), certificates from public logs, and code repositories from your source platform. Put everything in one sheet with these columns: asset, type, owner, environment, data it touches, last reviewed.
Then look from outside. Run discovery with free or built in tools for your cloud and DNS provider and compare against the sheet. Anything found but not listed goes in a second tab named "unknown". That tab is your first real finding set.
Two rules for the month. Every row needs an owner, even if the owner is "unassigned, escalated to the CTO". And do not fix anything yet unless it is clearly dangerous, such as an exposed admin login or a public storage bucket. Finish the picture before reacting to pieces.
Days 31 to 60: rank and fix
Rank assets on two questions: what could an attacker get, and how easy is it to reach? An internet facing login for a system holding customer data tops the list. A static marketing page sits near the bottom.
Take the top ten and fix what you can: remove what is unused, put admin interfaces behind your identity provider, close unneeded ports, rotate old credentials. For anything that runs software, check the versions against known issues. CISA's Known Exploited Vulnerabilities catalog lists vulnerabilities with observed exploitation and is a sensible filter for what to patch first. CISA itself says organizations should use it as an input to their prioritization.
Write down each fix and the date. This is your evidence for a customer questionnaire.
Days 61 to 90: make it routine
Shift from project to process. Add three habits.
First, an intake rule: no new internet facing system without an entry in the sheet and a named owner. Put it in the launch checklist for engineering.
Second, a decommission rule: when a project ends, someone removes its DNS records, cloud resources and credentials. Dangling DNS records and forgotten test environments are classic ways surfaces grow.
Third, a monthly review of the unknown tab and the top ten. Thirty minutes is enough if the data is clean.
When to buy something
By day 60 you will know where manual effort hurts. If your estate changes weekly, or you run many cloud accounts or acquired companies, a tool that discovers and attributes assets continuously may pay for itself. Bring your sheet to the vendor trial as ground truth. If your estate is small and stable, scripts and a calendar reminder can be enough.
What to measure
Use a short list. Percentage of assets with an owner. Number of unknown assets found per month, which should fall. Time from a new internet facing asset appearing to its entry in the sheet. Number of high risk exposures open past an agreed age.
Common traps
Starting with scanning and never building an inventory. Letting security own every asset instead of naming business owners. Treating the first sheet as finished: it will be wrong in a month. Fixing low risk items because they are easy.
Where Safeguard fits
Safeguard focuses on the application and software supply chain side: dependencies, code and the gates around build and release. It includes asset discovery with guardrails on discovered assets. It does not replace external attack surface tooling or your DNS and cloud inventory, which you need on top.
What to do
- Build one asset sheet from registrar, DNS, cloud billing, certificates and repositories.
- Add a second tab for anything found outside the list.
- Assign an owner to every row.
- Rank by data at stake and ease of reach, and fix the top ten.
- Use known exploited vulnerabilities to order patching.
- Add intake and decommission rules to launch and project checklists.
- Review monthly, and decide on tooling at day 60 with your sheet as the test.
Quick check
What should a small team do first?
Build a single asset list with an owner for every item. Fixing and tooling come after you know what exists.
How do you pick what to patch first?
Start with internet facing assets holding sensitive data, and use CISA's Known Exploited Vulnerabilities catalog to prioritize.
Sources
- CISA Known Exploited Vulnerabilities
- NIST SP 800-137, Information Security Continuous Monitoring
- NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
Last reviewed: 18 October 2026.
