Attack Surface Management in 2025: Why Discovery Outpaces Defence

In 2024, Shodan indexed approximately 750 million internet-facing devices and services. That number represents roughly the top 20% of what is actually reachable — purpose-built attack surface scanners reach farther and faster. Organised threat actor groups scan the entire addressable internet for new vulnerabilities within hours of public disclosure. The average time from CVE publication to active exploitation dropped to 12 days in 2024, down from 28 days in 2022.

Your security team does not have a scanning speed problem. They have a discovery problem: they cannot defend what they do not know exists.

The Scale Problem

The attack surface of a mid-size technology company grows at a pace that outstrips traditional asset management processes. Consider the typical sources of unknown exposure:

Cloud sprawl. Developer self-service in AWS, Azure, and GCP means new public endpoints, storage buckets, and API gateways appear without going through the security review process that governs on-premise deployments. A single-day sprint can create five new publicly reachable services.

Shadow IT. Marketing departments spin up SaaS integrations. Finance deploys invoice-processing portals. Individual engineers register product-adjacent domains for prototyping. None of these go into the CMDB.

Third-party exposure. Software suppliers, contractors, and service providers access your environment over connections that are correctly configured when provisioned and then drift. VPN clients go unpatched, web-facing portals accumulate forgotten credentials, partner integrations outlive the relationships that created them.

Historical infrastructure. M&A activity is the single largest source of unknown attack surface. Acquired companies bring IP ranges, domain registrations, and legacy systems that the acquiring organisation's security team has never seen. Two years after a typical acquisition, 30–40% of the acquired company's original internet-facing footprint is still reachable.

Credential exposure. Employees reuse passwords. Those passwords appear in breach databases. From the attacker's perspective, stolen credentials are attack surface — entry points that exist entirely outside your infrastructure but provide access to it.

What Modern ASM Covers

Attack surface management is a continuous programme, not a tool category. A complete ASM programme maintains visibility across five domains:

External Asset Discovery

Passive and active reconnaissance of all internet-facing assets associated with the organisation — domains, IP ranges, ASNs, and the services running on them. This includes assets not registered in your internal CMDB: forgotten subdomains, cloud assets registered under miscellaneous AWS accounts, domains acquired with past products.

Exposed Service Inventory

For each discovered asset, a continuous inventory of exposed services, open ports, and the software versions serving them. This is the layer where CVE prioritisation happens — you cannot determine whether a specific CVE is relevant to your environment if you do not know whether any system in your environment runs the affected software version.

Credential Intelligence

Monitoring of breach databases, paste sites, dark web forums, and code repositories for credentials associated with your organisation's domains. Exposed credentials — particularly those belonging to privileged accounts or service accounts with partner system access — are high-priority risk indicators that require immediate response regardless of whether the credential itself is still active.

Supply Chain Exposure

Monitoring the attack surface of your critical third-party suppliers and partners. Not their entire footprint — that is impractical — but the specific systems and services that have access to your environment or that could affect your customers if compromised. This intelligence feeds vendor risk management decisions and third-party incident response plans.

Digital Risk

Brand impersonation, typosquat domains, lookalike SSL certificates, and social media accounts misusing your brand identity. These are not traditional vulnerability categories, but they represent real attack vectors used in phishing campaigns targeting your employees and customers.

Common Blind Spots

Even organisations with mature security programmes have predictable gaps:

Non-web ports. Security scanners configured primarily for web application testing miss databases, message queues, industrial control protocols, and management interfaces exposed on non-standard ports. Shodan's data consistently shows exposed MongoDB instances, Redis servers, and Elasticsearch clusters that organisations did not know were internet-facing.

IPv6. IPv6 address space is too large for many scanners to cover comprehensively. Misconfigured dual-stack systems often have IPv4 access blocked and IPv6 access open — a gap invisible to IPv4-only scanning.

API gateways and microservices. Modern application architectures replace monolithic applications with dozens of discrete API services. Each service has its own authentication logic, its own dependency tree, and its own exposure profile. Traditional perimeter scanning captures the load balancer but not the microservices behind it.

Certificate transparency logs. Attackers monitor certificate transparency logs in real time to discover new subdomains as soon as TLS certificates are issued — typically within minutes of deployment, before any vulnerability management process would detect the asset. Defensive ASM should do the same.

Expired but accessible domains. Domains that lapse from registration can be re-registered by attackers and used for session hijacking, cookie theft, or subdomain takeover if DNS records were not cleaned up before expiry.

Continuous Monitoring vs. Point-in-Time Assessments

The quarterly penetration test remains a valuable, irreplaceable security control. But as a mechanism for attack surface visibility, it has fundamental limitations:

A penetration test captures a snapshot of your environment at the moment of testing. It misses assets created in the three months since the last test. It operates from a scoped asset list — meaning shadow IT, recently acquired infrastructure, and third-party exposure are typically out of scope. And its results are delivered as a report, not as a live data feed.

An adversary scanning for exposed Fortinet, Citrix, or Ivanti endpoints after a critical CVE drops does not wait for your next quarterly pentest cycle. They scan everything, immediately, and start exploitation within hours.

The operational model that closes this gap is continuous, authenticated ASM — maintaining a live inventory of your external footprint, monitoring it for new exposures, and feeding findings into your vulnerability management workflow with enough lead time to patch before exploitation.

This does not replace penetration testing. It changes what penetration testing is for: instead of discovery, a pentest becomes validation — testing whether the controls you believe are in place actually prevent exploitation by a skilled adversary.

What Effective ASM Looks Like in Practice

A mature continuous ASM programme has three operational capabilities:

Automated discovery and change detection. New assets are discovered within 24 hours of appearing. Changes to existing assets — new open ports, new software versions, SSL certificate changes — are detected and queued for review. The inventory is the ground truth; manual CMDB entries are cross-referenced against it, not the other way around.

Prioritised risk context. Raw exposure data is noise without context. Effective ASM overlays CVE severity with exploitability data (whether public proof-of-concept exploit code exists, whether the vulnerability is being actively exploited in the wild) and business context (whether the affected asset is externally facing, whether it handles sensitive data, what its downstream dependencies are). The output is an actionable prioritised remediation queue, not a list of CVEs sorted by CVSS score.

Actor attribution where available. For organisations in sectors targeted by specific threat actor groups, the most valuable enrichment layer is actor-specific intelligence: knowing that the vulnerability on your exposed VPN appliance is being actively exploited by the specific group that targets your sector changes the response priority from "patch this quarter" to "patch this week."

How OneGuard Approaches ASM

AmonSul built OneGuard specifically for the threat environment facing Ukrainian defence technology companies and critical infrastructure operators — sectors where the adversary is well-resourced, persistent, and specifically targeting exposed infrastructure as the initial access vector.

OneGuard's discovery pipeline combines passive OSINT (certificate transparency monitoring, DNS enumeration, BGP data, registrar feeds) with active scanning across all 65,535 ports. Findings are enriched with VATRA threat intelligence — the same actor profiles and infrastructure data that AmonSul's SOC uses for active incident response — so exposure findings carry actor attribution where it is available.

The programme is currently in early access with a limited number of design partners. See the OneGuard product page for details on the beta programme.