What is Attack Surface Management?

This document provides an overview of cyber attack surface management (ASM), defining what an attack surface is, differentiating physical and digital surfaces, and explaining attack surface discovery and common attack vectors (phishing, malware, compromised credentials, unpatched systems). It outlines core ASM program components—asset identification and prioritization, security ratings, network segmentation, and threat intelligence—discusses challenges in managing the attack surface, and promotes SecurityScorecard’s Attack Surface Intelligence and Security Ratings as tools to gain continuous outside-in visibility and manage internal and third-party risk.