Most attack surface mistakes come from a handful of beliefs: that the asset list is complete, that a certificate protects a hijacked subdomain, or that only public things count. Each is partly true, which is why they last. Here are seven, with what is actually the case.
Myth 1: We know all our assets
Fact: Teams create resources faster than lists are updated. Microsoft's guidance on subdomain takeover describes organisations that regularly create and delete many resources as being at particular risk, because records outlive the things they point to. Discovery from outside catches what the inventory lacks.
Myth 2: HTTPS means a hijacked subdomain is harmless
Fact: Microsoft notes that a threat actor can use a hijacked subdomain to apply for and receive a valid certificate, which can help them reach secure cookies and make a malicious site look legitimate. A padlock proves the connection is encrypted, not that the site is yours.
Myth 3: Only internet-facing things matter
Fact: External exposure is where attempts begin, but internal reach decides the damage. OWASP also lists unused features, old backups and extra deployed versions as parts of the attack surface to count, none of which look "public" on a diagram.
Myth 4: A smaller surface is always safer
Fact: Fewer entry points is a good aim, but a few badly protected ones can be worse than many well protected ones. OWASP advises ranking by risk: anonymous access, network-facing code, legacy interfaces and security-critical code come first.
Myth 5: Scanning my list covers it
Fact: A scanner reports on what it is given. See attack surface management vs vulnerability scanning.
Myth 6: One annual assessment is enough
Fact: OWASP says to reassess when the system changes, asking what is different and what holes may have opened. A new upload path or API type calls for fuller review. The surface moves every release.
Myth 7: This is a tool purchase
Fact: Tools help with scale, but the hard parts are owners, deadlines and removal. If nobody is told to delete the unused host, a better report changes nothing.
A short habit that beats most myths
Once a month, take the output of external discovery and ask three questions of every line: who owns this, why is it exposed, and what happens if we turn it off? Anything with no good answer to the first two is a candidate for removal.
If you have limited time, take two actions from this list: confirm every public hostname has an owner, and put a date on the next reassessment. They address most of the myths above.
Where Safeguard fits
Safeguard covers asset discovery and software supply chain scanning for what you build. It does not offer external attack surface management.
Quick check
What is the single most useful action?
Assign an owner to every internet-facing asset and delete the ones nobody will claim.
Sources
- Microsoft: prevent dangling DNS entries and avoid subdomain takeover
- OWASP Attack Surface Analysis Cheat Sheet
Last reviewed: 19 October 2026.
