Home Depot Data Breach 2014: $179M Cost, Timeline & Lessons
What Happened in the Home Depot Data Breach? The Home Depot data breach was one of the largest retail security incidents …
Find every potential entry point before attackers do with a systematic attack surface assessment.
• An attack surface assessment identifies all assets attackers could target, including the ones your security team doesn’t know about.
• Organizations using attack surface management tools reduced their average breach cost by $160,547, according to IBM’s 2025 Cost of a Data Breach Report.
• An assessment covers digital assets like domains and APIs, physical infrastructure, human factors, and third-party connections.
• The real value comes from discovering unknown assets that vulnerability scanners never check because they’re not in scope.
Most security teams think they know what’s exposed to the internet. They’re usually wrong. The average organization has 30% more external assets than their inventories show.
Those unknown assets sit unpatched and unmonitored. Attackers scan for exactly these blind spots. They don’t care if you forgot about a server. They’ll exploit it anyway.
An attack surface assessment solves this visibility problem. It’s the systematic process of finding everything an attacker could target, not just what’s documented in your asset inventory.
Here’s what attack surface assessment involves, why it matters, and how it fits into your broader security program.
Contents
What Is Attack Surface Assessment?
Security teams protect what they know about. The problem is they don’t know about everything.
An attack surface assessment is the systematic process of identifying all potential entry points an attacker could target. This includes internet-facing assets, internal systems, human factors, and third-party connections. The assessment reveals what exists, not just what’s documented.
Your attack surface is everything visible to attackers. Every subdomain, API endpoint, cloud bucket, and login portal. Every VPN gateway and remote access service. Traditional asset inventories miss a significant portion of this because they rely on documentation that’s already outdated.
An attack surface assessment starts with the assumption that your inventory is incomplete. It uses the same discovery techniques attackers use to find what’s actually exposed.
Why Do You Need an Attack Surface Assessment?
Unknown assets are prime targets. Attackers actively scan for forgotten servers, misconfigured cloud resources, and test environments that never got decommissioned.
Organizations using attack surface management tools reduced their average breach cost by $160,547, according to IBM’s 2025 Cost of a Data Breach Report. That’s the value of visibility.
Here’s what drives the need for an assessment:
Cloud sprawl creates blind spots. Developers spin up resources without a security review. Marketing launches microsites. Acquisitions bring unknown infrastructure. Each creates potential exposures that your vulnerability scanner doesn’t know about and thus can’t see.
Third-party risk keeps growing. Your attack surface extends into every vendor, API integration, and SaaS tool your organization uses. When they get breached, your data goes with them. Vendors with network access create even more risk.
Vulnerability scanners only check known assets. If a server isn’t in your scan scope, it doesn’t get checked. An attack surface assessment finds the assets that should be in scope but aren’t.
What Does an Attack Surface Assessment Include?
The assessment covers four categories of potential exposure.
Digital Assets
This is the largest category for most organizations. It includes:
- Domains and subdomains: Every web property connected to your organization
- IP addresses and network ranges: Both owned and cloud-hosted
- Cloud resources: Storage buckets, compute instances, databases, serverless functions
- APIs and web services: Both documented and undocumented endpoints
- Authentication surfaces: Login portals, SSO systems, VPN gateways, MFA implementations
- Email infrastructure: Mail servers, security gateways, SPF/DKIM configurations
Digital assets expand constantly. Every new cloud deployment, SaaS integration, or web property adds to the attack surface.
Physical Infrastructure
Physical security intersects with digital risk. Assessment includes:
- Network devices: Routers, switches, and firewalls with management interfaces
- IoT and OT systems: Connected devices that may have internet exposure
- Remote access infrastructure: VPN concentrators, jump servers, bastion hosts
Physical assets often get overlooked in digital-focused assessments. But a compromised network device provides the same access as a software vulnerability.
Human Factors
People are part of the attack surface too. The assessment considers:
- Publicly discoverable employee info: LinkedIn profiles, org charts, and social media that help attackers craft targeted phishing
- Social engineering vectors: Information that enables pretexting or spear phishing campaigns
- Security awareness gaps: Teams or roles more susceptible to attacks
Human factors are harder to enumerate than technical assets. But they’re often the easiest path for attackers.
Third-Party Connections
Your attack surface includes your vendors’ security posture. The assessment maps:
- Vendor integrations: APIs, data feeds, and system connections
- Supply chain dependencies: Software components and their sources
- Partner access: What external organizations have network access to your systems
Third-party involvement in breaches doubled to 30% in 2025, according to Verizon’s DBIR. You can’t assess what you don’t know is connected.
How Do Attack Surface Assessments Work?
The assessment follows a structured process that mirrors how attackers perform reconnaissance.
Discovery Phase
Discovery uses multiple techniques to find assets:
DNS enumeration reveals subdomains and associated IP addresses. Automated tools test thousands of potential subdomain names to find which ones resolve.
Certificate transparency logs show every SSL certificate issued for your domains. This catches subdomains that don’t appear in DNS records.
Port scanning identifies open services on discovered IP addresses. This reveals what’s actually running and exposed.
Cloud provider APIs can enumerate resources if you have access. This supplements external discovery with internal visibility.
The goal is comprehensive coverage. Miss an asset during discovery and it won’t appear in your assessment.
Inventory and Classification
Once discovered, assets need categorization:
- Ownership: Which team or department controls this asset?
- Business function: What purpose does it serve?
- Data sensitivity: What information does it handle?
- Technology stack: What software and configurations does it run?
Classification determines how you prioritize risks. A vulnerable test server matters less than a vulnerable payment processor.
Attack Surface Analysis
Analysis identifies what’s exposed on discovered assets:
- Open services: What ports are open and what’s running on them
- Visible misconfigurations: Public storage buckets, exposed admin panels, default pages
- Certificate issues: Expired, misconfigured, or missing SSL certificates
This gives you a map of your external exposure. For deeper vulnerability scanning, finding specific CVEs and missing patches, you’ll need to add discovered assets to your vulnerability management program.
Prioritization
Not every finding needs immediate attention. Prioritization considers:
- Exploitability: Is this exposure something attackers actively target?
- Business impact: What happens if this asset is compromised?
- Exposure level: How accessible is this from the internet?
Risk-based prioritization ensures your team works on what matters most first.
Attack Surface Assessment vs. Vulnerability Assessment
A Vulnerability assessment finds weaknesses in known assets. It scans systems you’ve already identified for missing patches, misconfigurations, and security flaws. It answers “what’s wrong with these systems?”
An attack surface assessment answers a different question: “what systems exist?” It finds assets first, including ones you didn’t know about.
The relationship is sequential. The attack surface assessment discovers assets. Vulnerability scanning checks those assets for weaknesses. You need both. Vulnerability scans only check what’s on the list. If an asset isn’t there, it doesn’t get scanned.
For a deeper comparison, see our guide on attack surface management vs vulnerability management.
How Often Should You Assess Your Attack Surface?
Point-in-time assessments aren’t enough. Attack surfaces change constantly.
Continuous assessments catch new assets as they appear. Cloud resources spin up daily. Subdomains get created for campaigns. Vendors add new integrations. Quarterly or annual assessments miss what happens between cycles.
Event-triggered assessments make sense for major changes:
- After acquisitions or mergers
- After org restructuring (new teams may have created unknown infrastructure)
- After significant infrastructure changes
- Following security incidents
Continuous monitoring is becoming the standard. EASM tools run assessments automatically, so you’re not relying on quarterly snapshots.
What Assessments Don’t Catch
An attack surface assessment finds your exposed assets. It doesn’t find what attackers already know about those assets.
Leaked credentials bypass authentication entirely. An attacker with valid passwords doesn’t need to exploit vulnerabilities. They just log in. Dark web monitoring catches credentials that have been exposed in breaches or stolen by malware.
Session tokens are worse than passwords. Infostealer malware captures active sessions that bypass MFA. Traditional credential resets don’t help because the session is already authenticated.
The most effective approach combines attack surface assessments with threat intelligence. Find your exposed assets AND monitor for leaked credentials attackers could use to access them.
Conclusion
An attack surface assessment finds what your asset inventory is missing. It uses attacker techniques to discover everything visible from the outside, giving you the same view of your organization that threat actors have.
Key points to remember:
- Attack surface assessments find assets, vulnerability scanning finds weaknesses. You need both working together.
- Unknown assets are the highest risk. They’re unpatched, unmonitored, and invisible to your security tools.
- Continuous scanning beats periodic. Attack surfaces change daily. Annual assessments miss too much.
- Attack surface assessments have limits. They find exposed assets but not leaked credentials attackers already have.
Start by understanding your actual external footprint. Check your dark web exposure to see what attackers already know, or book a demo to see how Breachsense provides complete external visibility.
Attack Surface Assessment FAQ
Attack surface testing validates whether discovered assets are actually vulnerable to exploitation. It goes beyond assessment (finding assets) to actively probe for weaknesses. Testing includes vulnerability scanning, penetration testing, and security configuration reviews. Assessment finds the doors and windows. Testing checks if the locks work.
ASM (Attack Surface Management) is the continuous process of discovering, classifying, and monitoring all internet-facing assets. It works by scanning the internet from an attacker’s perspective, finding domains, IPs, cloud resources, and APIs connected to your organization. ASM tools then monitor these assets for changes, vulnerabilities, and exposures.
Measure attack surface by tracking the total number of internet-facing assets, how many were unknown before discovery, open ports and exposed services, known vulnerabilities by severity, and third-party connections. The most important metric is remediation time, how quickly you fix discovered issues before attackers exploit them.
The three key components are continuous discovery (finding new assets as they appear), change detection (alerting when configurations change), and risk prioritization (ranking exposures by exploitability and business impact). Together, these ensure you maintain visibility as your attack surface evolves.
Attack surface management works through four phases: discovery (scanning for all connected assets), inventory (cataloging and classifying what’s found), assessment (identifying exposures and risks), and monitoring (tracking changes over time). The process runs continuously because attack surfaces change constantly.
Attack surface scanning is the automated discovery of internet-facing assets using techniques like DNS enumeration, certificate transparency logs, and port scanning. Scanners find subdomains, IP addresses, cloud resources, and exposed services. This gives you the same external view of your organization that attackers have during reconnaissance.
