Attacker's Perspective: What Attack Surface Management Reveals About Your Org - Lauren Palmer

Good morning everyone and thanks for making it to the session. Before I tell you a story, um I wanted you to think about your organization for a moment. Imagine listing every single asset you have exposed to the internet, every domain, login page or cloud service. Hands up. Who here thinks they could accurately make that list right now? No one. What if I told you that most people even in security couldn't? I've been in cyber security and defense for over 5 years and even with the best processes, something always slips through. Let me give you an example. We were running an external discovery for an organization expecting usual main sites, a few APIs, and some marketing

micro sites. But one result jumped out. A server unpatched running old version of WordPress. It was like walking down a street and spotting a house that's clearly been abandoned. Paint peeling weeds in the driveway, but the lights are still on and the front doors unlocked. This server had been forgotten about. It wasn't in their asset register. It wasn't being monitored. And here's the scary part. The organization's own telemetry showed that attackers were already walking in looking around. Attackers or their automated scans will find and test anything you expose online. Now imagine if that abandoned house had a filing cabinet full of confidential papers upstairs. It only takes one intruder to walk off with them. That one forgotten

system could expose customer data, damage trust, and trigger days or weeks of crisis mode. Hi, I'm Lauren Palmer. I'm a dog lover. And when my dogs aren't bossing around, I'm also the engineering team lead at Hexioc. We're a team of engineers with background in government, defense, consulting, and cyber, combining that experience to help our customers build and operate with confidence through our products and services. As the technical authority for our tax surface management platform, my job is to think like an attacker to see what they expose and help organizations identify, prioritize risks before they're exploited. Today, I'll walk you through that outside in perspective and how you can apply it with or without commercial tooling.

Before we can think like an attacker, we need to be clear on what we mean by attack surface. Your attack surface is some of everything your organization has exposed to the public internet. That includes domains, subdomains, IP addresses, APIs, login pages, code repositories, cloud storage, and third party services. If someone outside your organization can find it, it's part of your attack surface. [Music] If you drew your organization's attack surface on a whiteboard, what would it look like? You'd have your official website here, your main cloud services there, and maybe a couple of APIs, but then there are the shadow assets, things like temporary sites, forgotten development environments, and random marketing landing pages. And every time a new

domain is registered or service is deployed, that whiteboard changes. And here's the important part. It's not just the things you know about and manage. It's also the things you've forgotten and things you didn't realize were still online. and the things teams or other suppliers set up without telling you. Let me give you a few quick examples. A marketing micro site with admin access enabled, a temporary file sharing portal spun up for a project that never got taken down. A cloud storage bucket created by a third party contractor and left public. One of the biggest misconceptions I hear is it's not sensitive, it's not a risk. But attackers don't care if it's a static site with no customer data. They care

it's running old software or that it leaks hints about your internal systems. Even something as boring as an outdated about us page can help build a pathway into your organization. Across organizations I've worked with, unknown assets often outnumber the known ones three tone. And those unknowns are where hackers love to start. Quick check. Hands up if your organization has done a one-off asset inventory project and realized six months later it was already out of date. >> Yeah, >> that's the challenge. The attack surface is constantly changing. New services get spun up. Old ones get abandoned. And the internet never stops indexing, scanning, and pro. If you only look at your attack purpose once in a while, you're working

from an old map and the attackers are working from the live up to-date version. Now that we know what an attack is, let's look at how attackers actually go about finding it. If you've ever Googled your own name or your company name to see what comes up, you've already done a very basic form of reconsence. Attackers do the same thing just on a much bigger scale and with a lot more tools. And just like you might approach a big research project, they do it in stages, building a complete picture piece by piece. Let me let me walk you through what that looks like from their perspective. Step one is domain discovery. They start by mapping all the

names connected to your organization, brute forcing DNS, find subdomains, quering certificate transparency logs, finding who is records, and looking for naming patterns. Then they go on to service fingerprinting. Once they have the domains, they check what's running there. Tools like showan or census scan the internet constantly showing which ports are open, what services are listening, and the software versions in use. Of course, an attacker will push further probing vulnerability, trying login, exploiting weaknesses. Step three, we look at the technology stack profiling. Have they here they identify your CMS frameworks, third party services, hosting and CN setup even without sensitive data that gives attackers a list of possible weaknesses to check. Then we go to public data mining. They

search GitHub for leaked credentials, scan and paste sites for stolen data, scrape PDFs for internal usernames, and monitor social media for infrastructure hints. Step five is chaining the exposures together. This is where they put what they've discovered together. Rarely, there is a single golden key. More often, it's two or three smaller exposures chained together. Maybe an outdated CMS plus late leaked API keys that create a viable path in a highprofile real world real world case of this came from vulnerabilities in Avante's cloud service pl if you're not familiar with Avante. They're a US-based software vendor that builds IT service management and security products. One of their specialtities is remote access appliances like the Avante cloud service

appliance that sits at the very edge of a network. Because they're exposed to the internet by design and often have privileged access, they're high value targets for attackers. While none of customers by the breach have been named, their customer base includes University of Glasgow, University of GL of Oxford, and SCOD. names you'd all recognize, which shows just how high-profile and potentially farreaching the impact of such vulnerabilities can be. In late 2024, CISA and the FBI reported that attackers had been chaining together multiple vulnerabilities, an administrative bypass with an SQL injection flaw followed by multiple remote code execution bugs. Together, these allowed attackers to gain admin access, execute commands remotely, harvest credentials, and install web shells. In some cases, using the devices

as a springboard into deeper networks. It's a perfect example of how chaining exposures works in practice. No single flom if given them complete control, but combined create a direct route in. So, in practice, attack surface management isn't just about finding vulnerabilities. It's about discovering what exists even when you didn't know it there and understanding the risk it poses. Think of it like doing a rolling census of your digital state, finding every building you own online, checking whether the doors and windows are locked, and keeping tabs on whether anything new has popped up without you noticing. Whether you use commercialing, open source utilities, or collection scripts, the ASM process follow the same cycle. Discover, identify what's actually out

there. Keep an upto-date asset register. Audit your cloud services for forgotten or data assets. Monitor certificate transparency logs for new domains or subdomains. Investigate open ports to see what's accessible to the public. Assess understand that risk level. Check software versions against known vulnerabilities. Cvees determine which assets are exposed to the public internet. Catalog issues from most critical down to low priority. Remediate. Take action where it matters most. Find the highest risk or most damaging exposure risk. Decommission unused or abandoned services. Apply patches and close unnecessary open ports. Monitor. Keep watch because it will change. Continuously repeat discovery assessment. Set up alerts for changes in DNS certificates or cloud service deployments. Measure. Track your progress. Keep log

of the changes found and fixed. Measure time to remediation and exposure trends over months. Use these metrics to show improvement or spot where processes are slipping. Let me share you with you four examples to my own work and from recent news that why it matters in real life. As part of research for which into attack surface of major UK consumer brands, Hexioc ASM was used to scan 25 companies to map their exposed assets. From one well-known supermarket chain, we found a subdomain still pointing to a third party service they no longer used. The DNS record was live, but underlying service had been shut down. That left the door open for anyone to register the service and publish whatever they wanted

under the supermarket's legitimate domain name. By the time we spotted it, a hacker already claimed it and had it posted about the takeover publicly online. This meant the compromise was visible to the world before the supermarket even knew it had happened. They were able to regain control, but this is exactly why continuous monitoring is essential. In the time it takes you to notice, an attacker can already be making use of it. And while this was a case of hijacking something you already own, sometimes the risk comes from lookalike infrastructure you never owned at all. Another case we worked with a company hosting and maintaining the website for a large American corporation. An impersonator had registered multiple

lookalike domains, some with tiny misspellings, some hyphens, and using them to publish fake press releases. These weren't fishing sites. They were designed to spread misinformation because the fake content was fresh and keyword rich. Some of these domains started ranking above the corporation's official site Google search for certain topics. Using ASM and reconnaissance bills, we identified the impersonation domains traced our hosting and DNS providers and even found the reg contact details. With that evidence, the hosting company was able to send take down requests and to the relevant providers, cutting off the campaign. In that example, the attacker's goal was reputational damage. But sometimes the goal is direct access to sensitive data. And in 2021, researchers discovered a

misconfigured Amazon S3 bucket belonging to Premier Diagnostics, a CO 19 testing provider in the US. bucket was publicly accessible and contained about 52,000 patient records, including names, date of births, and medical insurance information. No login was required. Anyone who stumbled upon the bucket's URL could have downloaded lot. The issue came from human error and a lack of oversight. The bucket wasn't in the asset register and no one was monitoring it. After responsible disclosure, it was secured. But the stark reminder that data exposure can happen silently without any alarms if assets aren't tracked and managed. And while exposed data is bad enough, some exposures give attackers a direct way to your network. Which brings us to

the last example. In 2025, security researchers reported a case where attackers compromised an organization by an exposed desktop protocol service RDP in just 5 days. They used a password spray attack common credentials at scale to gain access. Once inside, they exfiltrated data and deployed ransom hub ransomware across the network. RDP remains one of the most abused services for initial access. A 2024 Selfish report and it was involved in over 90% of cyber attack cases. This example shows how a single forgotten service not on your asset inventory but still exposed can become the starting point for a fullblown instant in less than a week. ASM can't stop the attack itself but can find that exposure early so you can close it

before it's exploited. And these aren't just isolated examples. Hexiok has been working with NCSC's active cyber defense 2.0 trials which are exploring new ways to give UK organizations a clear real-time picture of their attack surface. Hexiok has also carried out national scale pictures of risk across universities and councils to show these challenges play out across sectorwide. The pattern is always the same. Exposures you didn't know about outnumber the ones you did. So what do we take from these four examples? One, you can't ex you can't secure what you don't know about. Keep an upto-date asset inventory. Not just what's in your CNB, but what's actually visible from the internet. Two, look beyond vulnerabilities. Grand abuse, misinformation, and data

leaks. They're all part of your attack surface. Three, don't assume something is safe. Abandoned infrastructure is often the easiest way in, just like an abandoned house with lights on. It can attract unwanted visitors. Monitor continuously, not just annually. Your attack surface changes daily. Your visibility should too. Think of it like checking on that regularly so no one moves in while you're not looking. Prioritize like an attacker. Fix exposures that would give you the quickest or deepest access first. ASM shines a light on the problems. Attackers try the door handle. ASM is not a silver ritlet, but it's one of the most effective ways to make sure you're not leaving an open invitation out on the internet or an open front

door with the lights on. Attackers are already scanning your organization. They don't care if you're startup, a global brand, or somewhere in between. If you're online, you're on their radar. ASM gives you the attacker's perspective, that outside end view, so you can see what they see and act before they do. Whether you're using a commercial platform, open source tools, or your own scripts, the principle is the same. Discover assess remediate monitor measure, and repeat. My challenge to you is this. Pick one area of your tax surface you've never looked at and go at it today. You might be surprised at what you find. Because in cyber security, the abandoned house with the lights on, still still on, isn't just a metaphor.

It's a real risk. And if you don't check it, someone else will. Thank you. [Applause] This is the work I every day and it's something I really care about. Um, I'm happy to take questions now. Um, but if you'd like to continue the conversation, I'll also be over at our table. Thank you. >> Any questions? >> Yeah. >> I say as I said previous talk, I'm teacher. I'm not in the industry, but I'm very struck by the concept of shadow assets and your idea that an asset inventory or registers help to keep track of that. >> Yeah. >> As I say, no expert. So, can you help understand how that's actually done effectively because I'm quite sure you

leave it to people just to keep a spreadsheet or something that missing or outdated or whatever. So, could you just outline briefly some of the tools you might use to do that? Um well not to trick my horn but you could use our ASM tool which will start to automatically get lists and dates. Um yeah the other way is uh using tooling. So you can like have tools that run and check for things or have alerts that automatically update documentation for you. Um I think trying to do it manually will always end up out of date as soon as you do it. And a subsequent followup question in that case out of the companies go and visit and see um how

many what percentage of people actually in control of what they've got because I seem to remember yesterday's discussion of assets like I'm fairly sure that people say they're over. >> Yes. So there's definitely the problem that like if you hire a contractor, they're going to like try and uh deploy fast as possible or find the solution as easy as possible. Um you've then got companies that are like tech startups that say like innovate and they're going to like raise uh create things as fast as possible. So they're going to spin up instances in the cloud and no one's going to know they're there. So yeah, it's about being able to monitor and being able to see

everything. So um I would definitely recommend like alerting so that um you're not you don't have to be told that stuff is happening. You're able to like see that it's getting done cuz um relying on people telling you it's never going to work. >> Thank you very much. >> Welcome. Anyways, >> just wonder if you see the conversation changing around SH more awareness and more interested in doing something about it or still just upill >> um I I definitely think that our customers are they know they've got shadow assets and particularly when they're already interested in ASM it is because they want to find out what they are and monitor Um but trying to um like if we like bulk

scanning or like those like national pictures of risk trying to explain to these to organizations that they have these things that don't exist when they're not even concerned about yet is

you talk about um using to scan your own infrastructure. Um obviously third party risk quite important because today we share a lot of data with third party firms. Can you use this as a way to measure the the risk of those third party organizations? >> Yes, absolutely. Um so the good thing about ASM in particular is that it's passive um non- inrusive. So it's designed for that attacker view but without going that step too far into CM. Um so we can do scans on vendors and third parties um without their consent. Um so you can get that view of finding out like is your vendor actually secure? Are they just telling you marketing information >> to help?

Yeah, we have quite a lot of customers who like to check their supply chain, but also um some people use it for like sales and like finding out like who's got what running as well.

>> Awesome. Well, thank you very much.