The Internet sees what you expose, not what your CMDB remembers
An attacker looks at what is actually reachable. Your records describe what somebody once wrote down.
The gap between those two is where incidents live. Scanning your own external footprint the way an outsider would, regularly, routinely finds things nobody knew were public: a forgotten interface, a test environment, a service that was supposed to be internal. The record is a description of intent; exposure is a fact.
More on Attack surface management
- A new subdomain can create a new perimeterThe fence just got longer
- Shadow IT becomes shadow attack surfaceDoors around the back
- Acquisitions merge attack surfaces before inventoriesThe wire arrives first
- Internet exposure is a property that changesThe tide does not read your map
- A forgotten test system can be a production entry pointThe shed is still joined to the house
- Third-party hosted assets still carry your nameTheir building, your name over the door