Lead Image © tarokichi, 123RF.com

ASM tools and strategies for threat management

Choose Your Armor

Article from ADMIN 85/2025

By Wilhelm Greiner

The tools used in attack surface management help identify attack surfaces more precisely and respond to changes in risk situations.

Identifying and exploiting vulnerabilities has been part of the attackers' trade for thousands of years. Just think of Hagen von Tronje, for example, who snuck up behind Siegfried, took aim with his spear, and murdered the purportedly invulnerable hero. He knew about the weak point in Siegfried's protective armor. Literary historians talk about Siegfried's death as an intrigue or honor killing, but as security professionals know, it was yet another case of inadequate attack surface management. In this article, I shed light on what is important in terms of IT security when reducing the attack surface.

ASM

Security analysts and providers use the term "attack surface management" (ASM) to describe tools and software-as-a-service (SaaS) offerings that are intended to enable enterprises – large corporations in particular – to identify their attack surfaces more precisely and respond more quickly to changes in their risk situation (see the "Prevention and NIS2" box). In their Leadership Compass publications on ASM [1], analysts at KuppingerCole states that ASM has "emerged as a crucial discipline that enables proactive cybersecurity strategies, mitigating risks by reducing an organization's exposure to potential attacks."

Prevention and NIS2

Dennis-Kenji Kipker, Professor of IT Security Law at the Bremen University of Applied Sciences, points out that NIS2 [the successor to the 2016 European Network and Information Systems Directive] is based on the principle of prevention; therefore, you look at what the attack vectors are so that if you do get compromised, you have an emergency management system in place, which ultimately also includes all risk management measures. From this point of view, he says, ASM can be

...

Use Express-Checkout link below to read the full article (PDF).