The Platform

Enable your security and operations teams to proactively identify, prioritize, and remediate exposures to stay ahead of attackers.

Watch a Demo
GigaOm Radar for Attack Surface Management

The expansion of an organization's attack surface continues to present a critical business challenge. Download the GigaOm Radar for Attack Surface Management to get an overview of the available ASM solutions, identify leading offerings, and evaluate the best solution for you.  

Use Cases

The CyCognito platform helps you identify all of the attacker-exposed assets in your IT ecosystem for a complete view of your attack surface.

State of External Exposure Management

Download CyCognito’s State of External Exposure Management Report to learn key recommendations that your Security teams can implement to improve their exposure management strategy and minimize risk. 

Our Customers

External attack surface management is advancing cybersecurity into a new era. Learn how security experts across all industries benefit from using CyCognito’s platform.

The Total Economic Impact™ of The CyCognito Platform

Read The Total Economic Impact™ of The CyCognito Platform — a Forrester study. Cost Savings And Business Benefits Enabled By The CyCognito Platform. 

About CyCognito

We believe all organizations should be able to protect themselves from even the most sophisticated attackers.

Contact us

The knowledge you need to manage and protect your attack surface.

What's New Blog

Principles of Attack Surface Protection: Time Crowns the Winner in Security

By Rob Gurzeev
CEO & Co-Founder
February 24, 2022

The principle of time permeates each aspect of attack surface protection that this series has covered. Contrasted to the other four principles — DiscoverAssessPrioritize and Remediate — time is like the unrelenting ticking of the race clock. Every time a new security gap is created, it is an all-out race between attackers and defenders, with the winner taking all. 

Respond too slowly, and you’ll allow attackers into your systems — no one will care that your detection or prioritization capabilities were top-notch. Act before attackers, and victory is yours. So how do you get and stay ahead for every single new security gap? Move quickly through those vital stages of securing the extended attack surface, shorten the response time and automate where you can. 

Time-Related Risks for the Stages of Attack Surface Protection

Consider some of the principal risks of time pertaining to each aspect of attack surface protection.

  • Discover: For most organizations, their external attack surface — assets exposed to the internet — is a mammoth, amorphous entity where many risks are shrouded in fog because they are in assets unknown to or not managed by, the security team. Time is of the essence when attackers are constantly pounding on your server, especially when it belongs to a subsidiary that you didn’t know was yours. Without good visibility, it can take weeks, potentially even years, to learn about unknown or unmanaged networks, cloud environments and even acquired subsidiaries.
  • Assess: Organizations typically assess the security of assets only periodically: once a month, a quarter or even a year. This gives attackers plenty of time to find the most attractive weak spots and attack them. Testing assets more frequently reduces the risk of a breach by exposing your security gaps sooner so security teams can address them. 
  • Prioritize: Risk prioritization requires classification of assets by business purpose. This core component of the prioritization process is normally done via an error-prone manual process. Prioritization delays can be deadly from a risk perspective, especially with security teams swamped by thousands of “urgent” alerts lacking context on how much risk they really carry.
  • Remediate: Mitigating the security gap, the last step for protection, demands maximum time efficiency from remediation teams. Prioritization is key for this step. Without a well-ordered list of fixes, ideally informed by business context and exploitability, remediation teams lose time fixing the wrong things. 

Speed up the Cadence to Improve Protection

The timing of each stage of protection has implications for enterprise security. Testing, which is the primary tool of assessment, often follows a cadence similar to an organization’s compliance regime. Standards such as the PCI Data Security Standard might require scans or tests quarterly, while other regimes might require only a semi-annual or annual test.

Giving attackers three whole months to find new security gaps and exploit them is a lifetime. This renders compliance regimes essentially meaningless as security guideposts. It may get you off the starting blocks, but chances are that the start of the race is the last time you’re even in the race, and attackers will find a way in well before you can fix it. 

There are thousands of offensive groups scanning various assets all of the time, so it’s really a situation where your one team is in a race against thousands of attacker groups. That is why it is so important to do everything you can to even the odds. Speeding the cadence of testing is one of these things. 

Improving the Key Indicator of Time: MTTR

Attackers continuously scan IP ranges at large companies, immediately exploiting what they find. So, mean time to respond, repair or remediate is a key indicator of a security team’s ability to control and reduce risks in a timely fashion.

For instance, at one of our customers, we identified a 15-year-old on-prem server connected to its network. No one knew the server’s purpose, so no one ever unplugged it. It functioned as an informal coffee table. Our platform discovered it was internet-exposed, easily seen and could be compromised and used in a lateral attack. Just finding vulnerable devices like this one can take months or years (if it’s ever discovered) — an MTTR that is unacceptably slow in today’s high-risk environment.


Time is critical for attack surface protection. Solid processes, automated at scale, help eliminate material risk faster for immeasurably stronger security. Focus on these three things as you work to reduce your process times.

1. When attackers find something before you do it will be exploited. At any given moment, you need to be able to identify — and report to management — on your top 10 security gaps. These typically create 90% of the business risk.

2. If your MTTR is measured in months, slow attack surface mapping and risk prioritization are usually the primary culprits. Focus on decreasing the time it takes to find networks, applications and cloud environments, especially those you weren’t previously aware of or don’t manage. And find ways to contextualize assets and risks.

3. Your security teams are already stretched to their limits. Empower them with automated solutions that accelerate the attack surface protection process so they can leverage their expertise where it matters most. 


Recent Posts

Top Tags

CyCognito Research Report

State of External Exposure Management

State of External Exposure Management

Download CyCognito’s State of External Exposure Management Report to learn key recommendations that your Security teams can implement to improve their exposure management strategy and minimize risk.

Dummies Book

External Exposure & Attack Surface Management For Dummies

External Exposure & Attack Surface Management For Dummies

As your attack surface has grown to cloud infrastructures and across subsidiaries, attackers are looking for and finding unknown and unmanaged assets to serve as their entry points.

Interactive Demo

Ready to Rule Your Risk?

Request a personalized walkthrough of the CyCognito platform to see how we can help your company identify all its internet-exposed assets, focus on which are most vulnerable to attacks, and accelerate your time to remediating critical risks.