Most organisations are not attacked through what they protect badly. They are attacked through what they do not know they have.

The size of the blind spot

Market estimates suggest organisations know roughly 62% of their own external attack surface. The remaining 38% hides in forgotten subsidiaries, shadow IT and digital supply chain dependencies — subdomains from old campaigns, staging environments that never went offline, APIs published by one team and inherited by no one.

External Attack Surface Management is the discipline of looking at your own organisation from the outside in, with the same eyes as someone hunting for an open door.

Four principles that hold the practice together

• Continuous discovery. An inventory taken once a quarter is out of date the moment it is finished. The surface changes with every deploy.

• Comprehensive inventory. Websites, cloud services, APIs and third-party hosted assets all count.

• Prioritisation by risk, not by volume. A list of ten thousand findings with no order is noise. What creates order is reachability, asset criticality and intelligence on what is being exploited right now.

• A complete cycle. Every exposure needs an owner, a status and verification that it was closed. A finding with no owner never becomes a fix.

Where to start

Before buying a platform, do the manual exercise: list the organisation's domains, resolve the subdomains, see what answers on port 443 and compare it with what the team believes it has. The gap between those two lists is your starting point — and, almost always, the biggest surprise of the quarter.