{
  "id": 9072479,
  "title": "Your attack surface is whatever the internet remembers — and it remembers more than you do",
  "url": "https://urgent.news/2026/09/22/your-attack-surface-is-whatever-the-internet-remembers-and-it",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-22T03:22:04.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/hexwardlabs/your-attack-surface-is-whatever-the-internet-remembers-and-it-remembers-more-than-you-do-1p08"
  },
  "original_language": "en",
  "account": "The attack surface of an organization is all the internet remembers about it, even if the company itself does not. This includes servers, subdomains, and other internet-accessible assets that may have been created for temporary purposes but are left running. Attackers scan the entire internet, looking for weak points in this attack surface rather than targeting specific known servers. One key factor in finding these forgotten assets is Certificate Transparency, a public ledger that records every HTTPS certificate issued. By checking this log, organizations can uncover subdomains that may have had certificates issued for them even if those subdomains were never used or documented. Once an asset is identified, a tool like ASM (Attack Surface Monitor) can scan it for common vulnerabilities like exposed databases or open remote access ports. Instead of scanning the entire list of potential targets, ASM focuses on the assets it has proven to exist by checking for corresponding HTTPS certificates. This approach reduces the number of false positives and gives organizations a clear, daily list of actual security issues to address. However, there is a limitation to consider: wildcard certificates, which cover all subdomains under a single domain, may not trigger ASM's scanning process. This means that even if a wildcard certificate is in use, ASM may not find any assets to report, even if those subdomains are actively accessible online.",
  "summary": "The problem starts with something perfectly reasonable Someone spins up staging.company.com for a client demo. The demo goes well, the client is happy, everyone moves on to the next thing. That server is still running. It is still running the version of the application from eight months ago. Its admin panel still has the password someone picked in a hurry. And nobody in the company remembers it…",
  "key_points": [
    "Attack surface includes all internet-reachable assets, not just known servers.",
    "Certificate Transparency logs reveal forgotten subdomains with issued HTTPS certificates.",
    "ASM scans identified assets for vulnerabilities, reducing false positives."
  ],
  "editors_take": "Relying on internet memory to define an organization's attack surface reveals hidden vulnerabilities in forgotten assets, forcing companies to adapt their security strategies to account for what they may not know exists.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}