Where this offering fits
Attack Surface Management concerns externally visible assets and exposures that may not appear in the internal inventory. The first task is attribution: determine which domains, addresses and services actually belong to the organisation. A discovered association should be reviewed before it is treated as an owned vulnerability.
Architecture and rollout decisions
Establish known seeds and business units, then validate representative findings with asset owners. Define how newly found assets enter remediation or inventory workflows. Test correction of an incorrect attribution. Keep external assessment separate from any intrusive testing, which requires its own written authorisation.
An evaluation scenario for this offering
Seed an evaluation with the organisation’s verified domains and a short list of externally hosted services. Include an old service whose ownership has changed and a legitimate affiliate with a similar name. Review the proposed discoveries with the asset register owner and record which associations are accepted, disputed or unresolved. Follow a confirmed exposure into the responsible team’s queue, then demonstrate correction of one mistaken attribution. The outcome should explain how external visibility improves the inventory without treating every association as an owned asset. Intrusive validation should remain outside this exercise unless separately covered by written authority.
Evidence to request for this scope
- Provide verified domains and asset ownership contacts.
- Review coverage and attribution confidence.
- Assign remediation ownership for confirmed exposures.