Attack surface management is the continuous work of finding every system an attacker could reach, ranking what you find and shrinking it. For a CISO the useful questions are coverage, cadence and ownership: do we know all our assets, how often do we look again, and who fixes what we find.
Why start with inventory?
You cannot defend what you cannot list. NIST Cybersecurity Framework 2.0 places asset management under its Identify function and spells out the inventories it expects: hardware, software and services and systems, supplier provided services, and data with its metadata, along with a representation of authorized network communication flows. The attack surface is that list viewed from outside: which of those things answer to the internet, and which do not belong at all.
The unknown items hurt most. A forgotten test server, an old marketing site, a cloud account a team opened for a trial: each can carry known flaws and no owner.
What cadence is reasonable?
CISA Binding Operational Directive 23-01, issued 3 October 2022 for US federal agencies, gives numbers worth borrowing, though a private company is not bound by them. It requires automated asset discovery every 7 days across the entire IPv4 space the agency uses, and vulnerability enumeration every 14 days. Detection signatures must be updated no more than 24 hours after a vendor release, and results are to be ingested into the central dashboard within 72 hours of completion. The deadline for the first two cadences was 3 April 2023.
You may choose different intervals. The point is that the intervals are written down, automated and measured.
How do you rank what you find?
Not every exposed asset matters equally. Combine exposure, sensitivity and exploitation evidence. CISA's Known Exploited Vulnerabilities catalog tells you which flaws are being used in the wild. For each entry CISA directs users to apply mitigations, evaluate internet exposure and stop using the product if no mitigation exists. An internet facing system with a KEV item goes to the top.
What belongs in the program?
External view. What does the internet see of us: domains, addresses, open services, certificates.
Internal view. Assets that never face outward but matter if an attacker lands inside.
Software view. Applications and their dependencies, which are part of the surface even when the server is well managed.
Cloud view. Accounts, storage, identities and exposed management interfaces.
Third parties. Suppliers' systems that connect to yours.
Constructed example: the old campaign site
During a quarterly discovery run the team finds a web server in a public cloud account answering on a subdomain used for a campaign three years ago. No one claims it. It runs an outdated framework with an entry on the KEV list. The program's rules fire: assign an owner, check for sensitive data, patch or remove. In this case, nobody needs the site, so it is deleted and the DNS record removed within a day. Without a weekly discovery cycle, it would have sat there until an attacker found it.
The scenario is invented, but forgotten campaign infrastructure is a familiar pattern.
Which metrics should a CISO ask for?
- Percentage of assets with a named owner.
- Time from a new asset appearing to its detection.
- Time from detection to owner assignment.
- Count of exposed assets with KEV items, and age of each.
- Share of the software dependency tree with a current inventory.
Ask for trends, not snapshots. A rising count of unknown assets is a process failure even if the absolute number is small.
Where does software fit?
For companies that ship software, the application dependency tree is a major part of the surface. Safeguard's asset discovery and dependency scanning help inventory what you build and run, and reachability analysis narrows which findings are on code that can actually execute. External exposure scanning of domains and ports is a separate job for other tooling.
How to check or apply this
- Define the asset inventory fields: owner, environment, data class, exposure.
- Automate discovery on a stated cadence, starting with weekly.
- Reconcile cloud billing and DNS records against the inventory.
- Tag findings with KEV status and internet exposure.
- Set owners and deadlines by exposure tier.
- Remove assets that have no purpose.
- Report the ownership and detection time metrics to leadership monthly.
Quick check
Is attack surface management a one time scan?
No. Assets appear and change constantly, so discovery has to repeat on a schedule. CISA's directive uses a 7 day cycle for asset discovery as an example.
Who owns remediation?
The owner of the asset. The security team finds and ranks issues, and the asset owner fixes them, so every asset needs a named owner.
Sources
- NIST Cybersecurity Framework 2.0, CSWP 29
- CISA BOD 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 18 October 2026.
