Attack surface management is the ongoing work of knowing what you expose and what is wrong with it. It has three parts: discovering assets, enumerating their vulnerabilities and tagging how exposed each one is. Each part needs an owner, which is why roles matter as much as tools.
What are the main types of work?
CISA's Binding Operational Directive 23-01 splits the job into two core activities. Asset discovery identifies what network-addressable IP assets exist and their addresses. CISA calls it non-intrusive and says it usually needs no special privileges. Vulnerability enumeration reports suspected vulnerabilities on those assets: host attributes such as operating systems, applications and open ports, outdated versions, missing updates and misconfigurations.
The directive's background states that continuous, comprehensive asset visibility is a basic precondition for managing cybersecurity risk. It also says visibility is not an end in itself. It exists to support updates, configuration management and remediation.
BOD 26-04, issued on 10 June 2026, adds the third type: exposure tagging. It tells agencies to continuously identify and tag assets reachable from outside the network with a routable IP address, and to record organization, environment (production or development), exposure (public or internal) and asset type (server, application or network device). Exposure is one of four variables, with KEV status, exploit automation and technical impact, that set remediation urgency.
Both directives are for federal civilian agencies. They are still a clear public model for anyone.
Where does software fit in?
NIST SP 800-53 control CM-8 asks for a system component inventory that accurately reflects the system, includes all components, avoids duplicates, and is reviewed at a set frequency. NIST's text says components include hardware, software and firmware, and that the information to track includes software owners, version numbers and license information.
A third-party library inside an application is a component. If your discovery process only sees IP addresses, it misses the vulnerable library behind a perfectly normal port.
What are the roles?
The directives speak mostly of agencies and CISA. The roles below are a practical split for a company, not a standard.
Asset owner. Accountable for each system, its purpose and its retention. Without a named owner, findings go nowhere.
IT operations. Runs discovery and patching. BOD 23-01 sets agency cadences of automated discovery every 7 days and enumeration initiated every 14 days.
Security team. Runs enumeration, prioritizes with exposure and exploitation data, and tracks coverage. The directive asks agencies to track how often they enumerate, what coverage they achieve and how current their signatures are.
Engineering. Owns the code and dependencies. Fixes arrive here.
Risk owner. Accepts or defers residual risk in writing.
A constructed example
A company has a quarterly scan of its main IP range. A developer launches a test API in a new cloud account and forgets it. Weekly discovery would have found it within seven days. Tagging would have marked it public, production-like and an application. The vulnerability list would have shown an old framework version. Nobody was assigned to the account, which is the role gap: the finding arrives, and no one is on the hook.
How to check or apply this
- Run discovery on a fixed cadence, weekly as a starting point, across every network range and cloud account.
- Tag each asset with owner, environment, exposure and type.
- Enumerate vulnerabilities with credentialed or agent-based methods where feasible, since CISA prefers privileged checks for managed endpoints.
- Include software components in the inventory, not only hosts.
- Prioritize public assets and known exploited vulnerabilities first.
- Measure coverage: share of assets scanned, age of results, assets with no owner.
- Assign every asset to a person.
Safeguard covers the software side of this: asset discovery, SBOM and dependency scanning, and reachability analysis that shows which vulnerable code is actually called. It is not an external attack surface product and does not map internet-facing hosts.
Quick check
What is the difference between asset discovery and vulnerability enumeration?
Discovery finds what assets exist and their addresses. Enumeration finds suspected vulnerabilities on those assets, such as outdated software and misconfigurations.
How often should discovery run?
CISA's BOD 23-01 requires federal civilian agencies to run automated discovery every 7 days. Other organizations can use that as a reference point.
Sources
- CISA, BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks
- CISA, BOD 26-04: Prioritizing Security Updates Based on Risk
- NIST SP 800-53 Rev. 5, CM-8 System Component Inventory (control text)
Last reviewed: 18 October 2026.
