The attack surface metrics worth tracking measure control: how many exposed assets have owners, how fast they get one, and how long risky exposure lasts. Raw asset counts, finding totals and unexplained risk scores mislead, because they rise when you look harder and say nothing about whether you act.
Why do so many ASM numbers mislead?
Discovery grows as tools improve. A count of assets or findings will often go up in the first months, which looks like a worse program when it is a better view. Metrics need to survive that. Prefer ratios and times to totals.
Which metrics matter?
Owner coverage. Share of discovered internet facing assets with a named owner. It measures accountability and does not rise just because discovery improved. Target direction: up.
Time to assign. Hours or days from first seen to a named owner. It reveals process friction. Report the median and the slowest decile, because averages hide stuck items.
Age of unresolved exposure. For assets that are unowned, unpatched against exploited flaws, or flagged for retirement, how long they have been in that state. Show it as a distribution by age band.
Exploited flaw exposure. Number of internet facing assets running software with a flaw listed in CISA's Known Exploited Vulnerabilities catalog, and how long each has been exposed. CISA recommends using that catalog as an input to prioritization.
Known versus discovered gap. Share of assets found by discovery that were absent from your register. If it falls over time, your records are improving.
Recurrence. How many new unowned assets appear per month, and from which teams or processes. It points at the source of the leak.
Which metrics mislead?
| Metric | Why it misleads | Better version |
|---|---|---|
| Total assets discovered | Grows with tool quality | Gap between known and discovered |
| Total findings | Counts noise and duplicates | Exposed exploited flaws by age |
| Single risk score | Method hidden, hard to challenge | Show the inputs |
| Scan coverage percent | Counts what you scan, not what exists | Coverage of the discovered set |
| Mean time to remediate | Skewed by a few extremes | Median plus oldest open |
| Alerts closed | Rewards closing, not fixing | Closed with outcome: fixed, retired, accepted |
How do you present them?
Choose five. Show each as a trend with a one line method note. Name an owner for each number. Mark any change in method with a visible line on the chart, since a new discovery source can shift every series at once.
Do not blend metrics into a single index for executives. If someone asks for one score, show it together with its parts.
What does a healthy trend look like?
Months one to three: asset counts rise, owner coverage low, time to assign long. Months four to six: owner coverage rises, time to assign falls, recurrence stays visible. Months seven to twelve: age of exposure shortens and the known versus discovered gap closes. If counts fall while owner coverage stays flat, check that discovery has not lost a source.
How do you keep numbers honest?
Write the definition of each metric once, including what is excluded. Review exceptions monthly. Have someone outside the team sample ten records against the reported figures. NIST SP 800-137 asks that continuous monitoring also assess how effective controls are, which includes the monitoring program itself.
What if leadership asks for a single number?
Offer a small panel instead: owner coverage, median time to assign, and age of oldest exploited exposure. Three numbers fit on one slide and each has a clear action behind it. If they insist on one, pick owner coverage and show the other two beneath it. Explain that a single blended score would hide which part needs work, and that you will revisit the panel each quarter as the program matures.
Where Safeguard fits
Safeguard offers asset discovery with guardrails on discovered assets, plus reachability analysis that separates flaws on live code paths from the rest, so exposure age can be reported for what matters. It does not claim external attack surface management coverage and does not replace an ASM tool.
What to do
- Choose five metrics from the first list and define each in writing.
- Report medians and distributions, not only averages.
- Mark any method or source change on every chart.
- Retire total counts from executive reports.
- Sample records monthly to confirm the numbers.
Quick check
Why is asset count a poor goal?
Better discovery raises the count. A rising number can mean progress. Track ownership, exposure age and the gap between known and discovered assets.
Is a single risk score ever useful?
Only with its inputs visible and a clear method. Otherwise it hides decisions nobody can challenge.
Sources
- NIST SP 800-137, Information Security Continuous Monitoring
- CISA Known Exploited Vulnerabilities Catalog
- FIRST, Exploit Prediction Scoring System
Last reviewed: 18 October 2026.
