Attack Surface Management Program
Continuous discovery, monitoring, and assessment of your organization's external attack surface and digital footprint. Our ongoing service provides real-time visibility into internet-exposed assets, shadow IT, misconfigurations, and newly emerging vulnerabilities, enabling proactive risk reduction before attackers can exploit these weaknesses.
In scope
- External asset discovery and inventory
- Continuous vulnerability scanning
- Cloud resource monitoring
- Domain and subdomain tracking
- Certificate management
- Shadow IT discovery
- Exposed credentials monitoring
- API security monitoring
- Third-party connection tracking
- Priority alert notifications
You receive
- Real-time attack surface dashboard
- Monthly vulnerability trend reports
- Critical exposure notifications
- Remediation guidance and verification
- Executive risk summaries
- Shadow IT alerts
- Quarterly attack surface reduction plans
- Risk prioritization framework
- Continuous improvement recommendations
Tiers
Choose the depth.
Standard Attack Surface Monitoring
$7.5K / mo
Continuous external discovery and vulnerability scanning for up to 5 root domains, up to 250 external IPs and up to 3 cloud accounts. Standard alert rules, critical exposure notifications and one monthly trend report.
- domains
- 5
- external ips
- 250
- cloud accounts
- 3
- Asset discovery and inventory with subdomain tracking
- Continuous external vulnerability scanning
- Certificate and exposed-credential monitoring
- Critical exposure notifications
- Monthly vulnerability trend report
- — Custom alert rules and risk scoring
- — Analyst-validated findings and remediation verification
- — Quarterly attack surface reduction plan
- — Penetration testing or exploitation of findings
Advanced Attack Surface Management
$12.5K / mo
Continuous monitoring for up to 15 root domains, up to 1,000 external IPs and up to 10 cloud accounts. Analysts validate findings, rank them by risk, verify fixes, tune custom alerts and deliver a quarterly attack surface reduction plan.
- domains
- 15
- external ips
- 1000
- cloud accounts
- 10
- Everything in Standard at the larger footprint
- Analyst validation and risk-ranked findings
- Remediation guidance and fix verification
- Custom alert rules
- Shadow IT and exposed API monitoring
- Quarterly attack surface reduction plan
- — Threat intelligence integration
- — Custom risk scoring model
- — Named dedicated analyst
- — Penetration testing or exploitation of findings
Enterprise Attack Surface Intelligence
$20K / mo
No fixed cap on domains, IPs or cloud accounts; footprint is scoped at onboarding, including subsidiaries and third-party connections. Adds threat intelligence integration, a custom risk scoring model, a named analyst and monthly executive risk summaries.
- Footprint scoped at onboarding, no fixed cap
- Subsidiary and third-party connection tracking
- Threat intelligence integration
- Custom risk scoring model
- Named analyst
- Monthly executive risk summary
- — Penetration testing or exploitation of findings
- — Hands-on remediation in client systems
- — Internal network vulnerability scanning
Members: engagement coupons from the CISO Marketplace coupon book apply to services. There is no blanket discount.
What's inside this engagement
Phase by phase.
How a advisory & fractional leadership engagement runs, what happens in each phase and what you see. Exact scope, tier and timeline are fixed in your proposal and SOW.
01Onboarding & baseline
Current program, risks, commitments and stakeholders reviewed.
You see · Access to leadership and existing documents.
02Priorities & roadmap
A risk-ranked roadmap agreed with leadership.
You see · Decisions on priorities and budget.
03Ongoing cadence
Regular working sessions, decisions and deliverables to the agreed scope.
You see · A named advisor and a standing rhythm.
04Reporting to leadership
Board and executive reporting in business terms.
You see · Board-ready updates.
Commercials
From first call to final report.
- 01
Scoping call
A practitioner, not a salesperson, walks through targets, constraints and what a good outcome looks like for you.
- 02
Proposal & rules of engagement
A fixed-scope proposal with tier, price and deliverables. Rules of engagement, contacts and out-of-bounds systems are agreed in writing.
- 03
Sign, then start
MSA and SOW are signed electronically and the deposit is paid. Only then does testing begin.
- 04
Execution
Testing runs to the agreed plan. Critical findings are escalated as they are found; you don't wait for the report.
- 05
Report & debrief
An executive summary plus technical findings with evidence, reproduction steps and fixes, walked through with your team.
- 06
Retest
Where the tier includes it, we verify your fixes and reissue the report, so auditors and customers see the issues closed.
Timelines are set per engagement in the SOW.
Related
Non-Human & Machine Identity Security
Assess and govern non-human identities — secrets, API keys, service accounts, workload identities, and AI agent identities — covering issuance, rotation, least-privilege, and lifecycle.
Zero Trust Security Assessment
Comprehensive evaluation of your organization's zero trust architecture implementation, examining identity verification, network segmentation, and access controls. Our assessment identifies gaps in your zero trust strategy and provides a roadmap for enhancing security beyond traditional perimeter-based approaches.
CISO Comprehensive Security Assessment
Holistic evaluation of your organization's entire security program across all critical domains. This efficient, structured assessment provides CISOs and security leaders with a complete diagnostic of security capabilities, maturity gaps, and prioritized improvement opportunities. Our comprehensive approach delivers actionable insights across governance, technical controls, and operational security to inform strategic decision-making and resource allocation.
Research
Latest from the blog
threat-intelligence · Aug 27, 2026
QScan and QTRouter Seized: The Federal Reserve, NASA, and the Senate Were Breached Through Somebody Else's IoT
On August 26, 2026, DOJ and the FBI seized two platforms operated by QTFY, a Chinese state-sponsored group employed by a Nanjing contractor. QScan mass- infected IoT devices worldwide; QTRouter turned them into an anonymizing relay network. Victims include NASA, the Federal Reserve, DOE, DOJ, HHS, NIH, and the U.S. Senate. The lesson is about your own edge devices — as infrastructure for someone else's operation.
operations · Aug 25, 2026
A Tale of Two SOCs: CISA Ran the Same Attack Against Two Organizations. One Caught It in Two Minutes. One Never Saw It.
CISA advisory AA26-237A, published August 25, 2026, documents red team assessments against two critical infrastructure organizations using comparable tradecraft. Organization B isolated hosts in 2 to 20 minutes. Organization A was fully compromised — domain, cloud, and the security team's own communications — and detected nothing. CISA attributes the gap to people and process, not tooling. That finding should change how you spend.
supply-chain-security · Aug 23, 2026
86 Minutes and 245 Million Downloads: The arrayref Rust Compromise and Why Build Scripts Are Your Blind Spot
On August 20, 2026, three Rust crates with a combined 245 million downloads shipped malicious versions that executed a remote payload at compile time. The crates were pulled within 86 to 107 minutes — and that speed is the problem, not the reassurance. Build-time execution means your CI runners were the target, not your production estate. Here is the response playbook and the structural fix.
Start an engagement