Attack Surface Management & Asset Inventory

What is attack surface management and asset inventory?

Attack surface management and asset inventory find every device, application, cloud resource and service an organization runs, including the ones nobody registered, and keep the list current. DigitalXForce does this with the Attack Surface Manager, a module of the TRiSCM™ platform that is defined in the DigitalXForce glossary. Attack Surface Manager discovers and inventories assets across nine asset classes, IT and OT, without agents and through APIs.

Why does the asset inventory come before control testing?

An asset missing from the inventory has no control test covering it. Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected, and it cannot see what its sources cannot see. An assurance gap is the time, or the set of controls, for which an organization has no current evidence that a control still operates as expected. An unlisted server or cloud account sits inside that gap until Attack Surface Manager adds it, which is why Continuous Control Assurance starts from an accurate inventory.

Does Attack Surface Manager need agents on each device?

No agents are needed. DigitalXForce reads from the systems it monitors through their APIs, using credentials that stay under the customer’s control. For assets inside the network, Attack Surface Manager also runs an on-site network sweep.

Does Attack Surface Manager replace our scanners or our CMDB?

Attack Surface Manager works with the scanners and the CMDB an organization already runs instead of replacing them. DigitalXForce connects to those tools through 250+ technology integrations, and the platform is built on a Cybersecurity Mesh Architecture, so each tool stays where it is and feeds one shared view.

How does Attack Surface Manager find assets nobody registered?

DigitalXForce builds the inventory from what Attack Surface Manager reads through APIs and the on-site network sweep, instead of starting from a list someone typed in. A device or service therefore appears in the inventory whether or not anyone registered it, in the same list as the assets the organization approved.

How does the asset inventory connect to the rest of DigitalXForce?

The 15 DigitalXForce modules, Attack Surface Manager among them, share one data layer. X-SPM is Extended Security Posture Management, the DigitalXForce capability that scores security posture across the enterprise and its vendors from the same control data, and it adds outside signals such as attack surface scans. The ESRPM module lists attack surface management among its capabilities and checks how each security tool is configured.

How does a team start with Attack Surface Manager?

The standard DigitalXForce proof of value runs for 4 weeks on the customer’s own systems and frameworks. Connectors are configured in week 1, and the attack surface and External Risk View are set up in week 2. The first assessments run in week 3 and are reviewed with the customer in week 4. DigitalXForce Lite runs the same on-site network sweep as the full platform.