Your attack surface is whatever the internet remembers — and it remembers more than you do

The attack surface of an organization is all the internet remembers about it, even if the company itself does not. This includes servers, subdomains, and other internet-accessible assets that may have been created for temporary purposes but are left running. Attackers scan the entire internet, looking for weak points in this attack surface rather than targeting specific known servers.

One key factor in finding these forgotten assets is Certificate Transparency, a public ledger that records every HTTPS certificate issued. By checking this log, organizations can uncover subdomains that may have had certificates issued for them even if those subdomains were never used or documented. Once an asset is identified, a tool like ASM (Attack Surface Monitor) can scan it for common vulnerabilities like exposed databases or open remote access ports.

Instead of scanning the entire list of potential targets, ASM focuses on the assets it has proven to exist by checking for corresponding HTTPS certificates. This approach reduces the number of false positives and gives organizations a clear, daily list of actual security issues to address. However, there is a limitation to consider: wildcard certificates, which cover all subdomains under a single domain, may not trigger ASM's scanning process.

This means that even if a wildcard certificate is in use, ASM may not find any assets to report, even if those subdomains are actively accessible online.