The Assets You Don’t Know You Own: Attack Surface Sprawl Is a Discovery Problem, Not a Tooling Problem

2026-08-03 at 18:48

By Ashish Khaitan

Modern organizations no longer operate within a fixed network perimeter. Cloud services, remote work, third-party integrations, and rapid digital expansion have made the boundary between “inside” and “outside” for the enterprise increasingly difficult to define.

Attackers exploit this ambiguity by scanning continuously for weaknesses across an organization’s hardware, software, cloud, and internet-facing assets. The uncomfortable truth security leaders must confront is simple: an organization cannot secure what it does not know it has.

Attack surface expansion is frequently framed as a tooling gap, but the evidence points elsewhere — toward a persistent, structural failure in attack surface discovery, asset discovery, and visibility.

Why Attack Surface Sprawl Happens

Attack surfaces expand for several identifiable and recurring reasons. Cloud adoption introduces new workloads, storage resources, and services that may be provisioned outside formal IT review processes, creating visibility gaps.

Effective cloud asset discovery has become important as organizations struggle to maintain awareness of resources created across distributed cloud environments. Shadow IT further increases complexity when business units deploy applications, platforms, or services without security teams being aware of their existence, creating additional shadow IT risk.

Multi-cloud environments can fragment visibility across different providers, each with varying configuration standards and security controls. During mergers and acquisitions, organizations often inherit unknown infrastructure and assets from newly integrated entities, making it difficult to establish complete visibility. Forgotten infrastructure, including systems that were intended to be decommissioned but remain accessible online, can continue to create exposure risks.

Third-party services also expand the attack surface by introducing dependencies on vendors, suppliers, and partners whose security weaknesses may impact the organization. In addition, temporary development environments are frequently left active, misconfigured, or unmonitored after their original purpose has ended. As organizations continue adding internet-facing assets at a rapid pace, traditional manual inventory processes struggle to maintain an accurate and complete view of the modern attack surface.

Discovery Is the Real Challenge

Security tools, firewalls, endpoint detection, vulnerability scanners, and vulnerability management tools can only act on assets that are already registered in an inventory. They cannot protect what has never been identified. This is why NIST’s Cybersecurity Framework places asset understanding at the very foundation of its Identify function: organizations must understand their data, hardware, software, systems, facilities, services, people, and supplier relationships before they can prioritize risk.

Traditional asset inventories, built on periodic audits and manual record-keeping, cannot keep pace with environments that change hourly. CISA’s own directive on federal network visibility frames this directly, stating that its core focus areas, asset discovery and vulnerability enumeration, are essential building blocks of operational visibility that many organizations still lack.

The visibility gap is not a failure of detection technology; it is a failure to first establish a complete, current record of what exists. Strong IT asset inventory security practices require organizations to continuously identify, classify, and monitor assets across their environments.

Why Organizations Lose Sight of Their Digital Assets

Government agencies and independent research organizations consistently point to the same conclusion: unknown and unmanaged assets represent a significant source of organizational risk. Without a complete understanding of what exists across an environment, security teams cannot accurately assess exposure, prioritize vulnerabilities, or reduce potential attack paths.

This challenge is reflected in CISA’s approach to asset visibility. CISA’s Binding Operational Directive 23-01 requires federal civilian agencies to maintain continuously updated asset inventories and identify vulnerabilities across discovered systems, emphasizing that comprehensive asset visibility is a necessary foundation for effective vulnerability management.

Similarly, CISA’s Cyber Asset Attack Surface Management (CAASM) resources highlight the importance of understanding and reducing exposure across software, hardware, and network environments, reinforcing the idea that organizations must first identify their assets before they can effectively protect them.

The UK’s National Cyber Security Centre (NCSC) has also emphasized the importance of visibility into modern attack surfaces. NCSC notes that threat actors continuously scan organizations’ hardware, software, services, and cloud assets to identify weaknesses. External attack surface management (EASM) approaches are designed to help defenders achieve comparable visibility into their exposed digital footprint.

NCSC’s Active Cyber Defence trials further demonstrated that organizations gained security benefits from EASM capabilities beyond vulnerability identification alone, largely because these tools improved awareness of externally exposed assets.

Cyble Research and Intelligence Labs (CRIL) has similarly documented how misconfigured and outdated internet-facing assets continue to expand opportunities for threat actors. Cyble’s research highlights sustained targeting of public-facing infrastructure, including exploitation patterns associated with campaigns such as the MOVEit-linked Clop ransomware attacks, demonstrating how exposed systems can become entry points for large-scale compromises.

The scale of exposed infrastructure further illustrates the challenge organizations face in maintaining visibility. Cyble’s ODIN platform identified more than 660,000 exposed cloud storage buckets and over 91 million exposed hosts, with more than 200 billion files accessible due to cloud misconfigurations. These findings demonstrate the extent to which digital assets can exist outside formal security oversight and create unknown exposure risks.

Cyble’s analysis of the attack surface management landscape also highlights that the discipline emerged in response to the growing need for organizations to discover unknown technology assets. The approach has evolved into complementary areas, including External Attack Surface Management (EASM), which focuses on internet-facing assets, and Cyber Asset Attack Surface Management (CAASM), which provides broader visibility into internal environments.

Together, these capabilities address the central challenge facing modern security teams: gaining an accurate understanding of the assets they need to protect.

Best Practices

Guidance from these sources converges on a consistent set of practices:

Continuous asset discovery rather than periodic, point-in-time audits.

External attack surface management to maintain an attacker’s-eye view of internet-facing infrastructure.

Asset inventory validation against NIST’s Identify function categories, including supplier and third-party systems.

Continuous monitoring for newly exposed services, certificate issues, and configuration drift.

Risk prioritization is based on exploitability and business impact once assets are known.

Third-party exposure management, since vendor and supplier assets extend the organizational attack surface.

Conclusion

The recurring theme across CISA, NIST, NCSC, and Cyble research is not a shortage of security tools; it is a shortage of visibility. Vulnerability scanners, firewalls, and detection platforms are only as effective as the asset inventory feeding them.

Organizations that treat discovery as a one-time or occasional exercise will continue to carry unknown, unmanaged, and forgotten assets into every future incident. Reducing organizational risk begins with a foundational discipline: knowing, continuously and comprehensively, what exists.

Know what’s exposed before an attacker finds it first. Get a Free External Threat Profile →