Your attack surface is everything an attacker can reach without your help: every hostname, IP address, open port, cloud resource, repository, identity endpoint and, increasingly, every model endpoint and agent that faces the internet. Attack surface management is the practice of knowing that set, continuously, and knowing it from the outside, the way an attacker learns it.

The outside part matters. Internal inventories describe what the organization intended to run. External discovery describes what is actually running under its name. The two are never the same.

Where unknown assets come from#

  • Decommissioned services whose DNS records still point somewhere. When the somewhere is a cloud provider where anyone can claim the name, the record becomes a subdomain takeover.
  • Prototypes and marketing sites launched outside the main deployment pipeline, often on a vendor's platform with your domain in front of it.
  • Cloud resources created by hand: storage buckets, databases with public endpoints, serverless functions with open URLs.
  • Vendor and agency infrastructure running under your domain, with your name on the certificate and their patch schedule underneath.
  • Acquisitions, renames and migrations that left the old perimeter running because nobody owned turning it off.
  • AI deployments: an assistant exposed for a demo, an MCP server stood up for an internal agent, a model endpoint with no authentication because it was supposed to be temporary.

How discovery actually works#

External attack surface management starts from seeds you already know, usually a domain and a few IP ranges, and expands them using sources an attacker would use.

  • Certificate transparency logs, which publicly record every TLS certificate issued and therefore every hostname anyone has bothered to secure.
  • Passive and historical DNS, which show where names have pointed over time, including the dangling ones.
  • Registration and ownership data, which connect domains, netblocks and autonomous systems to the same organization.
  • Web crawling and content fingerprinting, which find your brand, scripts and tracking identifiers on hosts you do not list.
  • Cloud provider APIs, when you grant read-only access, which turn guesswork about buckets and endpoints into a complete answer.

Each new hostname is then resolved, probed for open services, fingerprinted for software and screenshotted. The result is not a list of IPs. It is a map of what is reachable, what runs on it and who appears to own it.

Why continuous is not optional#

Attack surfaces change faster than quarterly reviews. A DNS change takes effect in minutes; a bucket policy changes in one click; a developer can expose a new service before lunch. Discovery that runs once produces a historical document. Discovery that runs every hour produces something a security team can act on: this appeared today, it was not here yesterday, here is who created it.

What to do with what you find#

Finding is half of it. Every discovered asset needs an owner and a decision: keep it and bring it into scope, or remove it. The hard cases are the ones nobody claims, which is why the first weeks of an attack surface program are as much organizational as technical. A short, visible list of unowned assets with a deadline for claiming them is the most effective tool we have seen.

How SecureX360 does it#

Discovery is the second stage of the CTEM loop SecureX360 runs. It starts from the domains, IP ranges and read-only cloud, code and identity connections you provide, re-maps everything attached to them every hour, and surfaces what is new, what changed and what nobody remembered, each with a first-seen time and a probable owner. From there, validation takes over: the point of knowing what you have is finding out which of it an attacker could use.