Cyber Exposure: Managing Security Risk Across the Modern Attack Surface

This article is based on analysis originally published by cso.com.au in August 2017. While some statistics reference forecasts from that period, the underlying concepts around attack surface management remain highly relevant.

Why the Security Industry Is Still Losing Ground

Despite hundreds of security vendors and billions of dollars in annual investment, the frequency and severity of cyberattacks continues to climb. The WannaCry ransomware attack of 2017 was a watershed moment, demonstrating that a single vulnerability — left unpatched across a global fleet of Windows systems — could cripple hospitals, telecoms, and logistics companies simultaneously. A report from Lloyd’s of London cited at the time estimated that a serious cyber attack could cost the global economy more than US $120 billion, comparable in scale to catastrophic natural disasters such as Hurricane Katrina.

The same report identified the most likely catastrophic scenario as a malicious hack targeting a major cloud service provider, with estimated losses of US $53 billion. The question worth asking: if the industry is aware of these risks, why does the situation keep getting worse?

The answer lies in a fundamental mismatch between the tools organisations use and the environments they are now trying to protect.

The Attack Surface Has Changed Dramatically

The network perimeter that traditional security tools were designed to protect — a relatively predictable set of servers, desktops, and network devices sitting inside a corporate data centre — no longer reflects how enterprise infrastructure actually looks. Several converging trends have fundamentally expanded and complicated the attack surface:

• IoT proliferation: Enterprise IoT devices — from smart building sensors to industrial controllers — introduce millions of network-connected endpoints that were never designed with security in mind and often cannot run traditional security agents.
• Cloud adoption: A 2016 IDG Enterprise Cloud Computing Survey indicated that 70 percent of organisations already had applications in the cloud, with further adoption on the horizon. Cloud workloads are dynamic: they spin up and tear down on demand, making static inventory models inadequate.
• Containers and microservices: DevOps practices have accelerated the adoption of containers and microservices architectures. A container might exist for minutes or hours — far shorter than the scanning cycles of legacy vulnerability management tools.
• Operational Technology (OT) and Industrial Control Systems (ICS): Critical infrastructure — power grids, manufacturing systems, water treatment facilities — was historically air-gapped. As these systems gain network connectivity, they become attack vectors without having been designed for frequent patching or software deployment.

Why Legacy Vulnerability Management Falls Short

Most organisations rely on a combination of Configuration Management Databases (CMDBs) and traditional Vulnerability Management (VM) scanning tools. Both have meaningful limitations in the modern environment:

• CMDBs provide an IT-centric inventory of assets and configurations. They were designed for change management workflows, not real-time security visibility. They are typically populated manually or through scheduled discovery, meaning they lag behind rapidly changing environments.
• Legacy VM scanners were architected for client/server, on-premise environments. They generally assess only known assets that are reachable at the time of a scan, or assets where an agent can be installed. Ephemeral cloud workloads, IoT devices, and OT systems routinely fall outside their coverage.

The result is a fragmented, point-in-time picture of security posture — one that is inherently incomplete and that does not map well to business risk.

Introducing Cyber Exposure as a Security Discipline

Cyber Exposure is a framework for continuously understanding, measuring, and reducing an organisation’s cyber risk across its entire attack surface — including asset types that legacy tools routinely miss. Rather than producing a static vulnerability report, a Cyber Exposure approach aims to deliver live, holistic visibility that encompasses:

• Traditional IT assets (servers, workstations, network devices)
• Cloud infrastructure and ephemeral workloads
• Containers and serverless functions
• IoT and mobile devices
• Operational Technology and Industrial Control Systems

From that continuous inventory, the discipline moves into assessment — not just identifying known CVEs, but also flagging misconfigurations, outdated antivirus definitions, high-risk user accounts, and other hygiene indicators. By correlating asset data with additional context — such as CMDB records, threat intelligence feeds, and business criticality metadata — security teams can prioritise remediation based on actual risk to the business rather than raw vulnerability counts.

An Analogy: Cyber Exposure and IT Service Management

A useful way to understand Cyber Exposure as a discipline is to compare it with IT Service Management (ITSM). ITSM provides a structured process for planning, delivering, and operating IT services. Its tooling — service desk platforms for managing incidents, CMDBs for mapping configuration items and dependencies — brings together workflows that would otherwise remain siloed.

Cyber Exposure aims to do the same for security. Just as ITSM created a shared operational language between IT teams and the business, Cyber Exposure creates a shared risk language between security teams and executive leadership. It moves security from a reactive, tool-centric function into a measurable, process-driven discipline with clear inputs, outputs, and accountability.

Communicating Cyber Risk to Executive Leadership and the Board

One of the persistent challenges for Chief Information Security Officers (CISOs) is translating technical vulnerability data into business terms that board members and C-suite executives can act on. Spreadsheets full of CVE scores do not directly answer the questions executives care about: Which parts of our business are most exposed? How do we compare to our peers? Where should we invest to reduce risk most efficiently?

A mature Cyber Exposure programme addresses this gap by producing metrics and visualisations that map security posture to business outcomes. Consider how other business functions manage exposure to risk:

• CRM systems give sales leadership visibility into revenue exposure and pipeline risk.
• ERP platforms surface financial and supply chain exposure.
• Human Capital Management (HCM) tools track employee satisfaction and attrition risk.

Cyber Exposure data should occupy the same strategic position — a quantified, comparable risk metric that informs investment decisions, M&A due diligence, regulatory compliance posture, and digital transformation initiatives. Rather than being an obstacle to business agility, a well-implemented Cyber Exposure programme becomes an enabler: it gives leadership the confidence to move quickly because risk is understood and measured, not unknown and feared.

Key Capabilities of a Cyber Exposure Programme

Regardless of the specific tooling an organisation chooses, a practical Cyber Exposure programme should deliver the following capabilities:

1. Continuous asset discovery: Automated, ongoing discovery of all asset types across on-premise, cloud, OT, and mobile environments — not just point-in-time scans.
2. Comprehensive assessment: Coverage of vulnerabilities, misconfigurations, and security hygiene indicators across all discovered assets, including ephemeral workloads.
3. Contextual prioritisation: Correlation of assessment findings with threat intelligence, asset criticality, and business context to surface what matters most.
4. Cross-team workflow: Integration with IT and DevOps workflows so that remediation is actionable and trackable, not just reported.
5. Executive-ready metrics: Dashboards and reporting that translate technical findings into business risk language for CISOs, CIOs, and board-level stakeholders.

Conclusion

The expansion of enterprise infrastructure into cloud, IoT, containers, and OT environments has outpaced the security tools most organisations rely on. Legacy vulnerability management approaches provide an incomplete picture of a fundamentally changed attack surface. Cyber Exposure — as both a concept and an emerging category of tooling — offers a path toward continuous, comprehensive, and business-aligned security visibility. For DevOps and security teams navigating complex, hybrid environments, adopting this mindset is less a future aspiration than a present operational necessity.