Attack Surface Management — Seeing What the Company Can’t

Here's a mindset that'll change how you hunt: your job as a bug hunter is to see the target's attack surface MORE COMPLETELY than the company sees it themselves. That's Attack Surface Management (ASM), and it's the frame that ties all your recon skills together. Let me explain.

What Is Attack Surface Management?

Your "attack surface" is everything about a company that's exposed to the internet and could potentially be attacked — every domain, subdomain, IP, server, API, cloud bucket, third-party integration, exposed service, and forgotten asset.

ASM is the discipline of discovering and tracking ALL of it. Companies do this to defend themselves. YOU do it to find the weak spot before they do.

The Big Insight: Companies Don't Know Their Own Surface

This is the whole opportunity in one sentence. Big companies genuinely do not have a complete picture of everything they own online. Why?

• Acquisitions bring in assets nobody tracks
• Old projects get abandoned but stay online
• Marketing teams spin up subdomains without telling security
• Cloud resources get created and forgotten
• Third-party tools get integrated and neglected

So there's always a gap between what they THINK they have and what they ACTUALLY have exposed. Bugs live in that gap. Your recon is about finding what fell through their cracks.

Building Your ASM View

This is where all your skills combine into one picture:

1. Seed domains — start with the known root domains in scope
2. Expand horizontally — find related domains (acquisitions, alternate TLDs) via WHOIS, favicon hashes, ASN lookups
3. Subdomains — CT logs, subfinder, amass, bruteforce (posts 18–19)
4. IPs & services — Shodan/Censys, port scans (post 22)
5. Cloud assets — S3 buckets, cloud storage, exposed cloud services (Part 4 coming!)
6. Code & secrets — GitHub recon (post 20)
7. Track it all — keep a living inventory, and DIFF it over time

The ASN & Acquisition Trick

Want to level up? Look up the company's ASN (their block of IP addresses) — it reveals ranges of servers they own that you'd never find via domains alone. And research their ACQUISITIONS — newly-bought companies often still run their old, less-secure infrastructure under the parent's scope. Acquired assets are notoriously under-secured because integration takes years.

Why This Frame Wins

Most hunters test the obvious main app and leave. The hunter with an ASM mindset has mapped fifty forgotten assets nobody else looked at. Same program, completely different opportunity. You're not competing for the same crowded endpoints — you're hunting the stuff only you bothered to find.