Attack surface management is certainly a concern for most organizations, but being top of mind does not mean it’s easy for organizations to understand or implement.