Attack Surface Management

Part I. Foundations of ASM

In these early chapters, we’re setting the stage for understanding attack surface management (ASM), a concept that has become essential in the industry. Whether you’re just starting out in the field or have been in it for years, the first three chapters cover ASM basics everyone needs to know. They ensure we are all on the same page before diving deeper. We start by answering the key question: What exactly is an attack surface?

You’ll discover the answer is not just about networks and servers anymore—attack surfaces include everything from software and hardware to people and processes. Essentially, attack surfaces are all the entry points that someone could use to access your systems, and managing them is about knowing where those points are, what risks they pose, and how to protect them.

We’ll dive into the details of how IT environments have evolved, including cloud services, IoT devices, and even employee smartphones. So many advances have expanded attack surfaces in ways we couldn’t have imagined a decade ago. This shift introduces new security challenges, and we’ll break down how organizations can address them. We’ll also introduce you to risk management strategies, which help you prioritize the vulnerabilities you tackle first based on their potential impact. By the time you finish Part I, you’ll have a strong understanding of ASM fundamentals and be well equipped to move forward, no matter your experience level.