Attack Surface Management Field Notes

Overview

Attack surface management is most useful when discovery, validation, and remediation context stay connected. A long asset list is not the result; a prioritized map of exploitable exposure is.

Workflow

1. Establish known domains, brands, and infrastructure owners.
2. Expand with certificate transparency, passive DNS, ASN data, cloud clues, and application fingerprints.
3. Validate live services and remove stale or duplicate noise.
4. Prioritize by business context, exploitability, and exposure age.

type Finding = {
  asset: string;
  exposure: string;
  impact: "low" | "medium" | "high" | "critical";
};

Reporting

Strong reporting gives engineering teams enough evidence to reproduce the issue and enough context to decide how quickly it needs to move.