Explain like I'm five · Security

What is Attack Surface Management?

Attack surface management, told as a story about walking around the castle with a thief's eyes and counting every door.

MAP FROM INSIDE5 doorsthe thief looks from outsidebeyond the wall are doors the map doesn't show

The map from inside shows five doors. But the thief looks from outside.Beyond the wall are doors the map doesn't show. The thief doesn't read our map — they look at what's visible from outside.

an old back doornobody locks it nowa door the third prince madethe guard room never knewa rented shed in the villagewith our chests inside→ west sheda signpost to nowherethe shed is gonea big castle has forgotten doors — and the thief looks for those first

A big castle grows forgotten doors.An old back door nobody locks, a door the guard room never knew about, a rented shed in the village, a signpost to a shed that's gone. These are the doors a thief looks for first.

what would a thief see???→ ??draw every door, window, and shed you can see — even the ones you didn't knowand around again tomorrow

Attack surface management is walking around the outside of the castle with a thief's eyes.Draw every door, window, and shed you can see — even the ones you didn't know about. Put a name on each one, and walk the circle again tomorrow.

Look from outsideexactly what the thief sees
Count them alleven the ones you forgot
Put a name on itwhose door, and why
Walk it dailydoors appear overnight
FROM INSIDE5FROM OUTSIDE9old back doorrented shedsignpostprince's doorthe 4 extra — the doors a thief finds firstclose it, put a name on it, or add it to the crack ledger

The difference between the two maps is where the thief goes first.The four red doors get closed, named, or added to the crack ledger. You can't patrol a door you don't know about.

OUTSIDE MAPCRACK LEDGERold back door — lockrented shed — name itsignpost — take downcarpenter?NEW!appeared last nightthe map notices before the ledger doesyou can't patrol or board up a door you don't know about

The map notices before the ledger does.A new door on the outside map goes to the crack ledger, and the carpenter boards it up. A door that appeared last night is caught on this morning's walk.

In one breath

Attack surface management = walk around the castle with a thief's eyes, count every door, window, and shed — even the forgotten ones, put a name on each, and walk it again every day.

Continuously discovering, classifying, and monitoring everything of ours visible from the internet — domains, IPs, cloud, forgotten servers — from an attacker's point of view. Vulnerability management patrols the rooms you know; ASM counts the rooms from outside.

When grown-ups say it

Attack surface
Every door visible from outside. The sum of everything a thief could touch. More doors, bigger surface.
External ASM
The map drawn from beyond the wall. Counts only what the internet can see; the halls inside are a different map.
Shadow IT
The prince's secret door. No bad intent — but the guard room never knew, so it never got locked.
Asset discovery
Counting doors. Before naming them, know how many there are. Step one of ASM.
Subdomains
Signposts to the castle. A signpost to a shed that's gone lets a thief put a fake shed there. → the village directory
Cloud exposure
A rented shed in the village. Our chests, outside the wall. → the outside storeroom keeper
Vulnerability management
Patrolling the rooms you know. Takes the doors ASM counted into the ledger. → the crack ledger
Reconnaissance
The thief draws the same map. Draw it before the thief does. → the team that plays the real thief
Next story
The Thief-Spotting Class for Everyone →
Want another term as a picture book? Request →