CAPABILITIES

FOR TEAMS

Blog/DISCOVERY//2 min read

Your asset inventory is not your attack surface

Every inventory is a list of things somebody remembered to write down. An attacker enumerates what is reachable, which is a different set and always a larger one.

WRITTEN BYHOG3 Labs, Platform
LENGTH399 words

The first thing a test does is ask what you own. The honest answer is that nobody knows, and the interesting work starts with admitting it.

Two different questions

An inventory answers what did we decide to run. An attack surface answers what currently answers a request. Those overlap heavily and they are not the same set, and the difference is where almost everything interesting lives: the staging host nobody decommissioned, the vendor subdomain pointed at a bucket that was deleted, the load balancer someone stood up for a migration in 2023.

31%
median surface found outside the provided scope

Across HOG3 estates where the customer supplied an asset list first

That number is not an indictment of anyone's CMDB. It is what happens when a list is maintained by people and a surface is maintained by DNS, certificate transparency logs, cloud APIs and whoever had deploy access last quarter.

Where the extra surface comes from

  • Certificate transparency. Every certificate you have ever issued is public and permanent. Hosts that were never meant to be found are found here first.
  • Inherited estate. An acquisition brings its own DNS, its own cloud accounts and its own forgotten hosts, and it is rarely re-inventoried.
  • Third parties in your namespace. A vendor on a subdomain of yours is your surface to an attacker, whatever the contract says.
  • Ephemeral that was not. Preview environments that outlived the pull request that created them.

Why this decides the rest of the test

Coverage is meaningless without a denominator. We tested everything you gave us is a true statement that can still miss the host an attacker uses, and a report that opens with a scope table copied from the customer's spreadsheet has quietly inherited the customer's blind spots as its own.

A test scoped from an inventory can only ever confirm what you already knew you had.

This is the argument for enumerating continuously rather than at kickoff. A surface that changes weekly cannot be described by a list agreed once, and the only version of that list worth trusting is the one regenerated on the day it is used.