Attack Surface Management Enhances Vulnerability Prioritization
Key Points
- Cybersecurity programs aim to manage risk and maintain business resilience, relying on timely vulnerability detection and patching, but the sheer volume of reported flaws makes a “find‑and‑fix” approach impractical.
- Traditional asset‑management tools miss about 30 % of an organization’s assets, leaving many vulnerable points exposed and untracked for attackers to exploit.
- The average patch cycle (60‑150 days) now far exceeds the speed at which adversaries can weaponize a vulnerability (as low as three days), highlighting the need for a more proactive defense.
- Attack Surface Management (ASM) complements vulnerability management by prioritizing risks with contextual insight, uncovering unknown external assets, and identifying misconfigurations, thereby reducing entry points before they can be exploited.
Full Transcript
# Attack Surface Management Enhances Vulnerability Prioritization **Source:** [https://www.youtube.com/watch?v=oMx9lgTtJnM](https://www.youtube.com/watch?v=oMx9lgTtJnM) **Duration:** 00:03:49 ## Summary - Cybersecurity programs aim to manage risk and maintain business resilience, relying on timely vulnerability detection and patching, but the sheer volume of reported flaws makes a “find‑and‑fix” approach impractical. - Traditional asset‑management tools miss about 30 % of an organization’s assets, leaving many vulnerable points exposed and untracked for attackers to exploit. - The average patch cycle (60‑150 days) now far exceeds the speed at which adversaries can weaponize a vulnerability (as low as three days), highlighting the need for a more proactive defense. - Attack Surface Management (ASM) complements vulnerability management by prioritizing risks with contextual insight, uncovering unknown external assets, and identifying misconfigurations, thereby reducing entry points before they can be exploited. ## Sections - [00:00:00](https://www.youtube.com/watch?v=oMx9lgTtJnM&t=0s) **Prioritizing Vulnerabilities for Faster Remediation** - The speaker explains that traditional vulnerability management is overwhelmed by thousands of flaws, gaps in asset visibility, and slow patch cycles, urging teams to prioritize high‑impact risks and adopt proactive offensive security techniques. ## Full Transcript
ultimately the goal of any cyber
security program is to manage and
mitigate risk in order to maintain
business resilience and Trust one of the
essential ways of doing this is by
monitoring for vulnerabilities in your
it estate and patching them as quickly
as possible this is vulnerability
management a find and fixed mentality
but it's becoming almost impossible to
operationalize this effectively
especially given more than 25
000 vulnerabilities were reported to
nist's database last year it's a
sisyphean task to close them all so the
real challenge teams have is where to
start and what to address first based
upon the biggest impact to your
organization
and that's not where the challenges end
in our experience organizations find
they have 30 percent more exposed assets
than they were tracking using
traditional Asset Management tools
security teams can only adequately
protect what they're aware of this
leaves many tempting vulnerabilities in
plain sight of attackers to exploit
before they're remediated
to make matters worse patching your
vulnerability typically takes between 60
to 150 days while adversaries have
dramatically cut the average time it
takes them to exploit a vulnerability
from three months to three days this
makes it abundantly clear why the find
and sticks approach alone is too slow
to get back on the front foot
organizations need to take a more
proactive offensive approach and build
greater resilience
as one of the most promising offensive
security Technologies today attack
surface management can be the perfect
complement to vulnerability management
a great ASM solution will allow you to
mitigate the Three core challenges I
just mentioned
firstly where to start most
vulnerability management tools rely on
the standardized CVSs severity school
and we've seen plenty of examples of
when a CVSs critical vulnerability is
actually really low risk to an
organization because it's all a system
that's not connected to the internet all
the vulnerable software isn't even in
use
a leading ASM solution can provide the
context that prioritizes vulnerabilities
based on the risk they pose to your
organization and the impact of them
being exploited
secondly an effective ASM proactively
scans your external attack surface just
like an attacker would to reveal that 30
portion of unknown assets and pass them
to your existing vulnerability
management solution to scan and protect
and finally ASM Solutions are designed
to identify risk even in the absence of
a vulnerability after all attackers
would likely prefer to take the easy
route of an exposed login page with a
default username and password rather
than spending their time exploiting
unpatched software ASM broadens the
scope from just vulnerabilities to
include misconfigurations like this and
other risk sources as well
so ultimately ASM focuses on reducing
the number of potential entry points for
attackers and vulnerability management
focuses on making those entry points
harder to exploit
combining the two leads to a much more
proactive and comprehensive approach to
reducing risk and increasing your
resilience to find out more click the
link to read our white paper on ASM and
vulnerability management and subscribe
to see more security videos from IBM