Attackers rarely start with the best-protected system. They look for the forgotten one: the test environment from three years ago, the old campaign page on a subdomain, the admin panel that was only meant to be public briefly. Attack surface management turns the perspective around and finds these systems before others do.
What is found
The starting point is the company’s domains. From there subdomains, IP addresses, issued certificates, open ports and the software running on them are identified, along with configurations such as DNS records and email protection with SPF, DKIM and DMARC. Each finding is assigned an owner and assessed: should the system be public, is it current, is it configured correctly?
Distinction
A penetration test examines a fixed scope in depth at one point in time. A vulnerability scan checks known systems for known weaknesses. Attack surface management answers the prior question of which systems exist at all, continuously, because the attack surface changes with every new service, every agency campaign and every cloud resource.
Typical findings at SMEs
Forgotten subdomains pointing to services no longer used that can be taken over. Outdated content management systems or plugins. Publicly reachable admin and login pages without two-factor protection. Expired or misissued certificates. Missing or lax DMARC records that make spoofing the company’s sender address easier. And test environments containing real data.
Getting started
Start with a one-off inventory of all domains and the systems behind them, with an owner for each entry, then repeat it regularly so new systems do not go unnoticed. For organisations subject to the Swiss reporting obligation, a known attack surface is also the precondition for detecting an incident in time.