Attack surface management is the ongoing work of finding, listing and reducing everything an attacker could reach. Its common uses are discovering unknown assets, spotting shadow IT, finding exposed services, tracking inherited assets after mergers, and feeding patch priorities. All of them depend on an accurate inventory that stays current.
Why does inventory come first?
You cannot protect what you do not know exists. NIST SP 800-53 has a control called System Component Inventory, CM-8, for exactly this reason.
CISA gave this a hard schedule for US federal civilian agencies in Binding Operational Directive 23-01. The directive says its requirements focus on two activities essential to operational visibility: asset discovery and vulnerability enumeration. Agencies had to perform automated asset discovery every 7 days, and vulnerability enumeration across discovered assets every 14 days. CISA acknowledged that full discovery of vulnerabilities on an entire enterprise may not always finish in that time. The numbers are a federal requirement, not a universal rule, but they show how fast an asset list goes stale.
What are the common use cases?
Finding unknown assets. Teams spin up test servers, marketing sites and cloud accounts that never reach the official register. Discovery from the outside, by looking at DNS records, certificates and open addresses, finds what internal records miss.
Reducing shadow IT. A department signs up for a service with a company email and stores customer data in it. Discovery of domains, sign-in flows and cloud accounts helps bring these into review.
Spotting exposed services. A database port open to the internet, a remote desktop service, an admin console, a forgotten staging site. These are the things an attacker will find in minutes with a scan, so you should find them first.
Subdomain takeover prevention. When a DNS record points to a service you no longer use, someone else may claim it. Reviewing DNS against live assets catches dangling records.
Merger and acquisition integration. A purchased company brings domains, cloud accounts and old systems. Mapping its surface early shows what you have inherited before you connect networks.
Patch prioritization. Knowing which vulnerable systems face the internet helps decide what to fix first. Internet-facing and exploitable beats internal and theoretical.
Third-party and supply chain visibility. The surface includes vendors' services connected to yours and the dependencies inside your own software. Inventory should cover both.
What do teams get wrong?
They treat discovery as a one-time project. Assets change daily, so a quarterly spreadsheet is stale by the time anyone reads it. They also collect findings without owners. A list of 4,000 exposures that nobody is assigned to fix does not reduce risk.
A constructed example
A retailer with 300 staff runs a weekly discovery pass over its registered domains. The first run finds 14 subdomains the IT team did not know about, three of them pointing to a cloud service the company stopped paying for. Two staging sites are reachable without login. The team assigns each finding to a named owner, closes the dangling records the same day, and puts the staging sites behind single sign-on. The next weekly run shows two new subdomains, both recognized, and the list is a short review instead of a project.
How to check or apply this
- Define the scope: domains, IP ranges, cloud accounts, code repositories, SaaS tenants.
- Run discovery on a schedule, at least weekly for internet-facing assets.
- Compare discovered assets against your register. Every difference needs an owner and a decision.
- Prioritize exposures by internet reachability and exploitability, not by count.
- Review DNS for records that point to services you no longer use.
- Include software inventory: know which libraries and components run where.
- Track time to fix and report it, so the program shows reduced exposure.
On the software side, Safeguard offers asset discovery along with SBOM and dependency scanning, which helps with the component inventory in step 6. It does not replace outside-in network discovery tooling.
Quick check
Is attack surface management the same as vulnerability scanning?
No. Scanning checks known assets for known flaws. Attack surface management begins earlier, by finding which assets exist and which are reachable.
How often should discovery run?
CISA's directive for federal agencies requires automated asset discovery every 7 days. Most organizations should treat weekly as a sensible floor for internet-facing assets.
Sources
- CISA BOD 23-01, Improving Asset Visibility and Vulnerability Detection
- NIST SP 800-53 Rev. 5 catalog, CM-8 System Component Inventory
Last reviewed: 18 October 2026.
