{"id":1144,"date":"2024-09-30T08:00:00","date_gmt":"2024-09-30T15:00:00","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=1144"},"modified":"2025-04-14T09:29:48","modified_gmt":"2025-04-14T16:29:48","slug":"think-your-attack-surface-is-covered-lets-look-at-the-math","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/think-your-attack-surface-is-covered-lets-look-at-the-math\/","title":{"rendered":"Think your attack surface is covered? Let’s look at the math."},"content":{"rendered":"\n

When it comes to security, organizations often consider themselves well-covered. But in today\u2019s landscape, where cybersecurity threats evolve at breakneck speed, even the most well-prepared teams cannot afford to have testing gaps. <\/p>\n\n\n\n

The reality is that if your primary strategy for removing security testing gaps is tightening scanning policies or expanding penetration test scope, you are trying to patch a dam with bubble gum. <\/p>\n\n\n\n

Is your attack surface covered?<\/strong> Let\u2019s take a deeper look at the reality behind security testing and how common approaches may leave you with larger gaps than you expect.<\/p>\n\n\n\n

The Math of Security Gaps<\/h2>\n\n\n\n

To calculate security testing gaps we need a risk model and relevant test criteria. Multi-criteria decision analysis<\/strong> (MCDA) is a great fit. For security testing criteria, we\u2019ll use coverage<\/strong>, accuracy<\/strong>, and frequency<\/strong>.<\/p>\n\n\n\n

Why these criteria? Security testing gaps are not just about coverage. Gaps in test frequency and test accuracy are just as problematic. <\/p>\n\n\n\n

What Does \u201cIdeal\u201d Security Testing Look Like?<\/h2>\n\n\n\n

We all know there\u2019s no standard when it comes to security testing. Each organization must tailor its strategy to its unique business needs, risks, skills and budgets.<\/p>\n\n\n\n

While this means the concept of ideal is subjective, the following are agreed upon truths:<\/p>\n\n\n\n