Third-party hosted assets still carry your name
A site run by an agency on your domain is still your exposure and still your incident.
The status page, the campaign microsite, the careers portal. Visitors cannot tell the difference, regulators will not either, and the supplier's patching schedule is now part of your risk. Anything under your name belongs in your inventory regardless of whose infrastructure it runs on.
More on Attack surface management
- The Internet sees what you expose, not what your CMDB remembersCounted three. Answering six
- A new subdomain can create a new perimeterThe fence just got longer
- Shadow IT becomes shadow attack surfaceDoors around the back
- Acquisitions merge attack surfaces before inventoriesThe wire arrives first
- Internet exposure is a property that changesThe tide does not read your map
- A forgotten test system can be a production entry pointThe shed is still joined to the house