A marketing team spun up a campaign microsite three years ago. Cloud bucket, a CNAME pointed at it, a certificate issued, a launch, a quiet retirement. The bucket was deleted. The DNS record was not. Attack surface management exists because that hostname is still in the certificate transparency logs, still resolving, and findable in seconds by anyone who runs the same free query your security team could have run. The question UK IT leads are actually being asked is not what the practice is. It is what it costs, and whether the bill is smaller than the alternative.
So this is the ledger, not the brochure.
What Attack Surface Management Actually Covers (And What It Does Not)
The working definition is continuous discovery, classification and monitoring of your internet-facing assets, performed from the outside in. No agent. No internal access. No credentials. The tool starts from something you own publicly, usually a domain name, and works outwards the way an attacker does: from the outside. If you want the mechanics in detail, our longer explainer on what external attack surface management actually is walks through the discovery chain step by step.
The scope boundary is where most budget conversations go wrong. External attack surface management looks at what the public internet can see. It does not see your endpoints, your internal subnets, your SaaS permissions or your identity sprawl. It will not tell you that a finance laptop is two patch cycles behind. Anyone selling it as a replacement for endpoint or internal vulnerability management is overselling.
Two myths worth killing before they reach your risk committee. First, passive external observation does not exploit anything; it reads what is already published, which means a finding often says “likely affected”rather than “is vulnerable”. Second, observing your own estate from the outside does not make you more interesting to attackers. The certificate transparency logs, the DNS records and the WHOIS history are public already, and they are being enumerated by people who did not ask your permission.
The important point about the output: it is a list of candidates to verify, not a certified inventory. Discovery from a seed domain returns hosts that are probably yours. Some belong to a partner. Some are a shared hosting coincidence. The tool hands you an inference, not a confirmed fact.
The Four Cost Lines Nobody Shows You in a Demo
Licence is the one you will see on a slide. The other three are the ones that surprise people in month two.
Licence or subscription
Pricing usually hangs off one of three things: seed domains, discovered assets, or IP ranges. Asset-count pricing has a perverse effect that nobody in the sales call will volunteer. The organisations with the most forgotten estate pay the most to find out they have it. A messy acquisition history, three defunct brand domains and a decade of campaign subdomains can inflate the first invoice before a single issue is fixed.
Ask two questions, in writing. How exactly is an asset counted (a hostname, an IP, a service, a certificate?). And do decommissioned assets drop off the bill, or does the count only ratchet upwards? Vendors who cannot answer crisply are telling you something.
Onboarding
Discovery needs somewhere to start. Somebody has to assemble the seed list: registered domains across every brand, registrar accounts including the one a departed employee set up on a personal card, known IP ranges, and the infrastructure that came with acquisitions. That work is unglamorous and it is yours, not the vendor’s. Budget a few days of a senior person’s attention, not an hour.
Triage in staff hours
This is the hidden cost of attack surface management, and it is attribution. The first inventory is almost always bigger than expected. Someone then has to decide, host by host, whether each candidate is genuinely yours, and who owns it. No tool settles that for you. It can score its confidence, it can show you the evidence trail, but the judgement is human. Plan for a focused block of effort in the first fortnight and a smaller recurring slice thereafter. The fields you record against each asset decide how much of that work you have to repeat next quarter.
Remediation
Findings land on teams who did not ask for them. Marketing owns the microsite. An agency owns the campaign page. A supplier hosts the widget. The infrastructure team, who you might expect to fix things, often has no access to any of it. That negotiation is a real cost and it is political rather than technical.
What an Unmanaged External Estate Costs Instead
Now the other column.
Subdomain takeover is the clearest cost asymmetry in this field. A dangling CNAME survives a cloud resource decommission because the resource is deleted and the DNS record is not. The name the resource used is released back into a shared pool. Anyone can claim it and serve content from your domain, with your name in the address bar, on a host your brand implicitly vouches for. Phishing, fake login pages, SEO spam. Repointing or deleting the record takes a few minutes. Explaining it to customers takes considerably longer. The control is a decommission checklist that removes the DNS record before the cloud resource, not after; the ordering is the whole trick, and we unpack it in more detail in our piece on the dangling DNS problem.
Expired or misissued certificates on a forgotten service. The failure is not technical and nothing goes down. Every visitor meets a full-page browser interstitial warning them away from you, and the first signal is usually the service desk rather than monitoring, because nobody was monitoring a portal nobody owns.
Exposed admin interfaces and legacy remote access. A Telnet or RDP service reachable on a public IP long after the site migration finished. External observation finds it immediately. An internal asset register misses it, because the register was never updated when the project closed. If you want to go looking yourself, start with exposed Telnet services, which remain uncomfortably common.
The slow cost is harder to invoice but it compounds. An asset register that no longer matches reality means every penetration test scope, every audit response and every incident begins with guesswork. You pay for that guesswork repeatedly, in consultant hours and in confident answers that turn out to be wrong.
Likely Versus Definitely: Why Prioritisation Decides the Return
Passive external observation infers exposure from banners, response headers and fingerprints. It reconstructs a probable software version and tells you the host is likely affected by a given CVE. It has not tested the flaw. Active scanning is what proves it.
Banners can be stale. They can be deliberately misleading. They can be rewritten by a CDN that has nothing to do with the origin server. Teams that escalate every passive finding as a confirmed vulnerability lose credibility with their infrastructure colleagues within about two cycles. That is how attack surface management programmes quietly die: not cancelled, just ignored.
Sequence it properly instead. Confirm the asset exists and is yours. Confirm the exposure is real. Then decide severity. In that order, every time. Our comparison of EASM versus vulnerability scanning goes further into where one hands off to the other.
When you judge a product, interrogate its prioritisation logic rather than its dashboard. Does it weight exposure, reachability and asset context, or does it simply stack CVSS scores and sort descending? A sorted CVSS list is worse than useless, because it gives false confidence that the top of the list is the thing to fix.
Beyond CVEs: The Issue Classes That Carry Real Weight
Most of what external discovery surfaces is not a CVE at all.
Misconfigurations: open storage buckets, directory listings, debug endpoints left enabled, default credentials on an appliance nobody remembers commissioning. Certificate hygiene as an operational signal, where the transparency logs reveal estates you forgot you built, including the ones a third party built on your behalf (see what certificate transparency logs do and do not show you). And exposed interfaces that are not vulnerable in any catalogued sense but should never have been public: a staging environment, a database admin panel, a router login.
None of these is exotic. They are the ordinary sediment of an organisation that has existed for a few years and moved quickly. Coverage beyond CVEs is so a buying criterion, not a nice extra, because a tool that only matches version strings will miss the majority of what is actually wrong.
Keeping the Cost Down: Noise Control and a Sensible Cadence
Alert fatigue is a configuration failure, not an inevitability.
The real product is change detection. You want to be told what is new or newly different, not handed the whole inventory again every cycle. Three controls do most of the work: tag every asset with a named owner before the second scan, suppress known-and-accepted findings with an expiry date rather than permanently, and review in a weekly batch rather than streaming alerts into a channel nobody reads. Suppression without an expiry is how a decision made in March becomes an invisible risk in November.
Cadence should match how fast your estate moves. A static estate behind one hosting provider can tolerate monthly checks. A cloud-heavy estate with multiple development teams changes daily, and against that an annual assessment is a snapshot of a river. Our note on why point-in-time scanning falls short covers the trade-off.
A manual pass is genuinely enough for some organisations. One domain, a handful of services, no acquisitions: run free certificate transparency and DNS queries yourself, quarterly. The trigger points that justify paying are an acquisition, a cloud migration, more than a couple of hundred hostnames, or a regulatory requirement for evidence of continuous coverage.
A Short Buying and Starting Checklist
Write the objective before you take a demo. Fewer unknown assets, faster detection of new exposure, or documented evidence for an auditor are three different goals and they favour different tools. Be honest about which one you are actually buying.
Then ask: what discovery techniques are used, and against which data sources? How fresh is the data, and how often is it refreshed? How is attribution confidence expressed, and can an analyst see the evidence? Is active testing available as an option, and under what authorisation? How do findings reach the ticketing system your engineers already use? Our practical buying checklist expands each of these.
Treat the result as a complementary control. External discovery tells you what exists and is reachable. Vulnerability management tells you what is wrong with the things you already know about. Neither replaces the other, and buying a second scanner when what you lacked was discovery is the most common way money is wasted here.
A workable first 30 days: seeds in during week one, inventory reviewed and attributed in week two, a named owner against every confirmed asset in week three, and the three worst exposures closed by the end of week four. Three. Not thirty.
Document the regulatory direction while you are at it. The NCSC’s guidance on asset management is clear that you cannot protect what you have not enumerated, and the UK government’s Cyber Security and Resilience Bill policy statement, published in April 2025, points towards stronger duties on knowing and managing your estate (the Bill was still progressing through Parliament at the time of writing, so check its current status before quoting specifics). We have a separate piece on what to fix first under the Bill. Both point the same way. An unknown asset is an unmanaged one.
The Short Version
- Attack surface management is continuous outside-in discovery of internet-facing assets. It does not cover endpoints, internal networks or identity, and it does not exploit anything.
- The licence is rarely the biggest cost. Attribution and triage hours are, because discovery returns candidates and only a human decides what is genuinely yours.
- Ask how assets are counted and whether decommissioned ones leave the bill. Asset-count pricing charges the messiest estates the most.
- Passive findings are inferences. Confirm ownership, then exposure, then severity. Escalating “likely”as “confirmed”destroys the programme’s credibility faster than any technical failure.
- Subdomain takeover is the sharpest asymmetry: minutes to fix, months to live down. Delete the DNS record before the cloud resource.
- Alert fatigue is a setting, not fate. Owner tags, time-limited suppression and a weekly batch review.
- If your estate is small and static, run free discovery queries yourself. Acquisitions, cloud sprawl and audit evidence are what justify paying.
Frequently Asked Questions
What does attack surface management actually do that vulnerability scanning does not?
Vulnerability scanning tests assets you have already listed. Attack surface management finds the assets missing from that list, working from public data such as DNS records, WHOIS history and certificate transparency logs. The two are complementary: discovery decides the scope, scanning decides the detail.
How much does attack surface management cost to run?
Pricing varies widely by vendor and by model (per seed domain, per discovered asset or per IP range), so get quotes against your actual estate rather than a list price. Add onboarding effort to assemble seeds, and recurring staff hours for attribution and triage. For most mid-sized organisations the people cost in the first month exceeds the monthly licence.
Does external attack surface management scanning make my organisation more of a target?
Passive observation reads public records, so it changes nothing about your visibility. Those records are already being enumerated by others. Active testing is different and should be scoped, authorised and scheduled, particularly where third-party hosting is involved.
How often should external assets be checked for new exposure?
Match the cadence to how fast the estate changes. Cloud-heavy environments with frequent deployments warrant daily or continuous change detection; a small, static estate can reasonably run monthly or quarterly. The useful alert is the one about something new, not a reprint of the whole inventory.
Can we do attack surface discovery manually before buying a product?
Yes, and it is a sensible first move. Free certificate transparency searches, DNS enumeration and registrar records will surface a meaningful share of forgotten hosts, and our guide to finding forgotten internet-facing assets for free sets out the method. What manual work cannot give you is continuity, which is the point at which a product starts to earn its licence.