What Attack Surface Management Misses Once You Are Inside the Network

Key Takeaways

• Attack surface management tools show what an outside attacker can see: domains, IP ranges, certificates, exposed services and cloud assets. Their view largely ends at the perimeter.
• The internal attack surface, made up of east-west paths, legacy servers, management interfaces and loosely segmented networks, is where most of an intrusion plays out. Standard ASM tools are not built to map it.
• Adding more discovery sources produces a longer asset list. It does not tell you which internal assets an attacker can reach from a given foothold.
• Reachability analysis models real network topology to determine whether an attacker can get to each vulnerability. In most environments, only about 1% can be reached.
• Effective attack surface reduction pairs external discovery with internal reachability: close what is exposed outside, then cut the specific paths that lead to critical systems.

What ASM Tools Cover and Where Their Visibility Stops

Attack surface management started with a plain problem: most organizations could not say what they had on the internet. Forgotten marketing sites, test environments left running, assets inherited through acquisitions, cloud buckets someone spun up on a corporate card. Every one of those is part of the cyber attack surface, and none of them showed up in the CMDB.

External attack surface management (EASM) tools solve this from the outside in. They enumerate domains and subdomains, sweep IP ranges, read certificate transparency logs, fingerprint running services and flag exposed ports, expired certificates and misconfigured storage. The output is a map of the organization as an attacker on the internet would see it.

Cyber asset attack surface management (CAASM) takes the inventory view. It pulls records over API from EDR, scanners, cloud consoles, identity providers and the CMDB, then deduplicates them into a single list of assets with owners and attributes.

Both jobs matter. EASM finds what is exposed. CAASM tells you what exists. Neither one tells you how those assets connect to each other.

That missing layer is the network itself: firewall rules, routing, ACLs, NAT, load balancer configuration and segmentation policy. It decides what an attacker can do after first access, and it sits outside the data model of both tool types. EASM sees the front door. CAASM knows the rooms exist. Nobody is checking which doors between the rooms are open.

The Internal Exposure That Standard ASM Tools Do Not Reach

The internal attack surface is bigger than the external one in almost every enterprise, and it carries more legacy debt. A few categories account for most of it.

• East-west paths through "segmented" networks. Segmentation on the architecture diagram and segmentation in the firewall rulebase are rarely the same thing. An any-any rule added during an outage, a VLAN that was supposed to be temporary, a jump host with routes into three zones. Each one quietly connects segments that were meant to be separate.
• Legacy and unmanaged systems. ERP on an aging Windows Server build, mainframe gateways, VMware hosts, Oracle databases, OT and IoT devices that cannot take an agent or a patch on short notice. These systems often hold the data and processes the business runs on.
• Management planes. vCenter, out-of-band interfaces like iLO and iDRAC, backup servers, hypervisor consoles and RDP or SSH bastions. They carry the highest privileges in the network and are frequently reachable from ordinary user subnets.
• Internal services with critical CVEs. Your scanner already flags these by the thousands. ASM does not see them because they are not internet-facing, and the scanner cannot say which ones an attacker could actually get to.
• Inherited trust. Service accounts, shared credentials and flat domain trust let one compromised host stand in for many. They turn a single reachable box into a launch point.
• None of these show up on an external scan. Some appear as rows in a CAASM inventory. What neither view captures is the path between them.

How Attackers Move From External Footholds to Internal Assets

Astelia's founders spent years running offensive operations for the Israeli National Red Team. Real intrusions rarely look like a single exploit against a crown-jewel server. They look like a sequence, and most of that sequence happens where ASM has no view.

1. Initial access. An exploited VPN appliance or firewall, a phished credential, an exposed remote access service. Vulnerability exploitation is now the leading initial access vector, behind 31% of breaches in the 2026 Verizon DBIR. This is the one step ASM is built to help prevent.
2. Orientation. From the foothold, the attacker asks one question: what can this host talk to? CVSS scores don't come into it. What matters is which services answer.
3. Lateral movement. The attacker hops through whatever is reachable, exploiting an internal service here, reusing a harvested credential there. In our red team work, a single reachable server often became the pivot for an entire operation, sometimes before any exploit was ready for it.
4. Privilege and objective. Domain controllers, backup infrastructure, databases, hypervisors, OT. The assets that matter most usually sit two or three hops in.

If ASM did its job, it may have flagged the asset in step one. Steps two through four took place in territory it never mapped.

The timeline is also shrinking. Frontier AI models can turn a published CVE into a working exploit in hours. The old habit of parking internal findings because they "aren't exploitable yet" no longer holds. The question that does hold is whether an attacker can reach the vulnerable service at all.

Why Broader ASM Coverage Does Not Fix the Internal Visibility Problem

The usual response to an internal blind spot is more coverage: another connector, an internal scanning module, a bigger inventory. Each of these adds value. None of them closes the gap, because the gap is structural.

ASM is built around an inventory, a set of nodes with attributes. Reachability is a property of the edges between nodes. Whether host A can reach port 443 on host B depends on every firewall rule, route, ACL and NAT policy along the way. Adding more nodes to the list does not produce that answer.

Internal scanning has a similar limit. A scanner in one subnet tells you what that scanner can reach. It does not tell you what a compromised workstation in another segment can reach. Running active probes from every segment to every other segment would be slow and noisy, and in production or OT environments it is often not allowed.

Then there is the prioritization problem. Map 40,000 critical findings to asset owners and you still have 40,000 critical findings, now with names attached. Security asks IT to patch. IT pushes back on change windows and production risk. Without proof of which findings an attacker can actually reach, both sides are guessing.

Attack surface reduction is ultimately about cutting paths, and you cannot cut a path you have not mapped.

How Reachability Analysis Closes the Gap That ASM Leaves Inside the Network

Reachability analysis starts where ASM stops: with the network topology. (We cover the broader case in The Blind Spot in Exposure Management: Reachability.)

Astelia connects through read-only integrations to the firewalls, WAFs, load balancers and vulnerability scanners you already run. From that data it builds a model of how traffic can actually move across your on-prem, hybrid and cloud environment. No one has to document the topology beforehand, and no active probing touches production.

Agentic AI then works out what each vulnerability needs in order to be exploited: the port and protocol, the service configuration, the position an attacker must hold. Astelia checks those exploit requirements against the topology, from the internet and from internal footholds. Either a path to the vulnerable service exists or it does not.

In most environments, about 1% of vulnerabilities turn out to be reachable. Each one comes with its full attack path. For the other ~99%, you get network evidence showing why an attacker cannot get there, which is the answer auditors and boards ask for when you decide not to patch. At one large US telecom, 2.91 million vulnerabilities came down to 31 true attack paths.

That changes how teams fix things. When a patch does not exist or cannot ship in time, Astelia points to remediation beyond patching: a firewall rule change, tighter segmentation or a compensating control that breaks the path. IT gets a short, defensible list instead of a backlog.

This does not replace attack surface management. Keep EASM for external discovery and your scanner for findings. Reachability is the layer that tells you which of those findings an attacker can actually use once they are inside. For a look at how vendors handle this, see our guide to top exposure management platforms.

Book a demo to find & fix the 1% of reachable vulnerabilities in your own network. 

FAQs

Is attack surface management the same as vulnerability management?

No. Attack surface management discovers and inventories assets and exposures, especially ones the security team did not know about. Vulnerability management finds and tracks software flaws on known assets, usually with scanners like Tenable, Qualys or Rapid7. ASM answers "what do we have and what is exposed?" Vulnerability management answers "what is vulnerable on it?" Exposure management adds the question that drives remediation: which of those vulnerabilities can an attacker actually reach?

What is the difference between EASM and CAASM?

EASM discovers internet-facing assets from an outside perspective, without credentials, which makes it good at surfacing shadow IT and forgotten infrastructure. CAASM pulls data over API from tools you already own, such as EDR, CMDB and cloud consoles, to build one reconciled inventory and expose coverage gaps like servers with no EDR agent. EASM finds what you don't know about. CAASM organizes what you do. Neither models the network paths between assets.

How do ASM tools integrate with existing vulnerability scanners?

Most ASM platforms import scanner results or trigger scans against newly discovered assets, so findings attach to the right asset and owner. CAASM tools also use scanner data to flag assets that never get scanned. These integrations improve coverage and context, but prioritization usually still leans on CVSS or vendor risk ratings. The number of "critical" findings landing on the team stays roughly the same.

What role does lateral movement play in attack surface risk?

Lateral movement is how a single foothold becomes a serious breach. Most high-value systems are not internet-facing, so attackers get to them by moving host to host over allowed network paths and reused credentials. That makes internal connectivity part of the attack surface. A critical CVE on an internal server can only be exploited if a path to it exists from somewhere an attacker can land.

How often should attack surface management assessments run?

External discovery should run continuously, or at least daily, because new cloud assets and DNS records appear all the time. Internal assessment should track change: a firewall rule update, a new segment, a migration or a fresh batch of scanner findings can each alter what is reachable. Quarterly reviews leave long windows where one rule change opens a path no one notices.