Attack vector, attack surface & exposure management

An attack vector is the path an attacker uses to get in: a phishing email, an exposed login page, an unpatched VPN, a stolen password. Your attack surface is the total of every such path: each internet-facing host and API, every account, every third-party connection, and every person who can be tricked. A vector is one door; the surface is all the doors and windows together. The word comes from medicine: in malaria, the mosquito is the vector. It does not cause the disease, but it carries the parasite from one person to the next, so killing mosquitoes or blocking their bites stops the spread. Attack vectors work the same way: close the route and the payload never arrives.

Attack surface management (ASM, or EASM for the internet-facing part) starts with discovery, because you cannot defend what you do not know you own. Forgotten subdomains, test APIs and old cloud storage are the classic finds. Reduction then follows three moves: remove what is not needed, harden what has to stay (authentication, patching, least privilege, segmentation), and keep watching, because new exposure appears every time someone ships something.

Gartner's Continuous Threat Exposure Management (CTEM), introduced in 2022, turns this into a five-stage loop: scoping, discovery, prioritization, validation and mobilization. Two ideas set it apart from a yearly scan. Validation asks whether an exposure can really be exploited, and mobilization means the owning team actually fixes it rather than a ticket going stale.