Insights into the Team Cymru State of Attack Surface Management Survey

8 Reasons to reassess your ASM strategy

In our recent survey: The State of Attack Surface Management , we surveyed 440 security practitioners in the US and Europe who work on their company’s security team. Each organization surveyed had to use attack surface management, or ASM platform, and these professionals were able to provide first-hand knowledge about the benefits and drawbacks of ASM tools today.

This survey is vital reading if you are new to ASM or looking to compare your current experience to see how you measure against other organizations.

It’s critical for organizations to have effective solutions that enable security teams to protect their organization from cyber-attack. But are the tools and methods being used appropriate for modern security teams, or are technology gaps leaving organizations vulnerable?

We’ve condensed the contents of our survey to eight key takeaways. These high-level insights provide a flavor of what you can find in the complete report and will enable you to assess and potentially evolve your current approach to ASM.

Insight №1.: Shadow IT

While freedom and control over their own IT environments may help users across the organization do their jobs more efficiently, it opens unchecked entry points for cybercriminals and is a potential disaster for the company. A growing organization continuously adds elements to its infrastructure without following policies or best practices, and often the security team is the last to know about it.

This is why 20% of respondents say their organization implemented ASM to increase their visibility of shadow IT in the enterprise; other surveys have discovered this to be sometimes over 50%. According to 23.4%, identifying rogue or unclassified events is the most valuable capability that ASM has provided their organization.

PRO TIP: YOUR ASM TOOL MUST HAVE BOTH CONTINUOUS AND AUTONOMOUS DISCOVERY OF UNKNOWN OR NEW ASSETS AND BE ABLE TO AUTOMATICALLY SCAN FOR VULNERABILITIES TO EXPOSE SHADOW IT RISKS.

Insight №2. Cloud Migration

16.3% of our respondents say that errors associated with moving more data and assets to the cloud are the primary reason their attack surface is expanding.

Illustrating the effect of expanding attack surfaces in the cloud, Verizon’s 2022 Data Breach Investigations Report (DBIR) states that misconfigured cloud storage accounts for 13% of breaches.

PRO TIP: YOUR ASM TOOL MUST HAVE INSIGHTS INTO THE APPLICATION LAYER AND TECHNOLOGY STACK ACROSS ANY CLOUD ENVIRONMENT, IN ADDITION TO MAPPING THE UNDERLYING INFRASTRUCTURE TO FULLY REVEAL THE EXTENT OF DEPENDENCIES AND RISKS OF APPROVED AND UNAPPROVED CLOUD APPS.

Insight №3. Lack of Integration

14.5% cite the main limitation of existing ASM platforms as their lack of integration with automation platforms. For security teams to gain even more advantages over static reports, they need more integrations. However, legacy ASM tools can be challenging and expensive to update and maintain. As ASM 2.0 tools mature, the industry will undoubtedly benefit from the more time-saving integrations it can provide.

PRO TIP: THE MORE CAPABILITIES YOUR ASM TOOL HAS, THE LESS COMPLEX INTEGRATION BECOMES, SAVING TIME, MONEY, AND EFFORT ON STITCHING TOGETHER MULTIPLE TECHNOLOGIES, WORKFLOWS, AND PROCESSES. LOOK FOR ASM PLATFORMS THAT, AS A MINIMUM, INTEGRATE ASSET MANAGEMENT, VULNERABILITIES MANAGEMENT, AND CLOUD INFRASTRUCTURE MANAGEMENT IN ADDITION TO THREAT INTELLIGENCE — IT IS MORE EFFICIENT TO INTEGRATE A SINGLE PLATFORM THAN SEVERAL.

Insight №4. Required Training

When security solutions need an inordinate amount of time dedicated to training before users can effectively do their jobs, they burden already struggling security teams. This is why a plurality of 21.5% indicates that the training needed for analysts to use the platform is their primary challenge with their current ASM platform.

PRO TIP: YOUR ASM TOOL NEEDS TO BE MORE THAN FULLY FEATURED; IT MUST HAVE MANY OF THE LABOR-INTENSIVE AND REPETITIVE TASKS AUTOMATED AND RUNNING CONTINUOUSLY — THIS MEANS MORE EMPHASIS ON USING THE PLATFORM, NOT LEARNING THE METHODS. ANOTHER KEY POINT IS THE USER EXPERIENCE. EVALUATE HOW SEAMLESSLY ASM INTEGRATES MULTIPLE COMPETENCIES AND ASSESS HOW EASY TASKS CAN BE DONE. IF ANYTHING LOOKS COMPLEX OR TIME-CONSUMING, MOVE ON.

Insight №5. Time to Deploy

Of our respondents involved in deploying their current ASM solution, 23.2% said it took 6 to 9 months to get them up and running. For 18.5%, it took over a year — a long time to leave their organization vulnerable to unmanaged risks.

The time it takes to deploy and implement a new security solution is consequential because it expresses the amount of time the organization continues to go without the protection provided by the improved processes. The frustration created by a new implementation is also a challenge for security teams looking to get up and running quickly and smoothly.

PRO TIP: YOUR ASM NEEDS TO HIT THE GROUND RUNNING. ASSESS HOW MANY OF THE FEATURES ARE AUTOMATED AND DON’T REQUIRE TIME OR TRAINING TO ACHIEVE VALUE, IN ADDITION TO FUNCTIONS THAT CAN EASILY BE CONTROLLED, SUCH AS ASSET DISCOVERY AND VULNERABILITIES SCANNING. IF YOU AREN’T GAINING A FRICTIONLESS EXPERIENCE DURING EVALUATION OR PROOF OF CONCEPT, CHANCES ARE YOUR ASM WILL TAKE MONTHS TO INTEGRATE INTO YOUR ENVIRONMENT.

Insight №6. Security Concerns

Integrating a new platform or giving an untested solution broad access across the enterprise will keep a CISO up at night. This is especially worrisome considering that 29.7% of our respondents said their top concerns were about the security aspects of data integration and how much access their current ASM platform had across the enterprise.

PRO TIP: ASM IS CURRENTLY A BUOYANT MARKET FOR INVESTORS, BUT THAT ALSO BRINGS RISKS FOR PROCUREMENT. YOUR ASM PROVIDER SHOULD PASS YOUR STANDARD THIRD-PARTY ASSESSMENTS AND ESPECIALLY BE COMPLIANT WITH ISO27001 TO GIVE ASSURANCES THEY TAKE YOUR DATA, SECURITY, AND INTEGRITY SERIOUSLY. AS PART OF THAT ASSESSMENT, CASE STUDIES, PROVENANCE, AND FINANCIAL ASSESSMENTS PROVIDE INSIGHTS TO SEPARATE THE TARGET ACQUISITION START-UPS FROM LESS RISKY, MORE STABLE AND BETTER-ESTABLISHED ORGANIZATIONS.

Insight №7. Cost

Legacy ASM solutions fail to deliver an adequate ROI for modern cloud-based enterprises. Many ASM users did not fully realize the initial benefits promised when they acquired their solution as well.

21.1% of the respondents felt they overpaid for their current ASM solution. Of those who plan to stop working with their ASM vendor in the next 12 months, 21% cite the cost of operation and maintenance.

PRO TIP: AS AN ASM BUYER, AUTOMATION IS THE KEY TO LOWERING OPERATIONAL COSTS. PREMIUM SERVICES WILL HAVE A HIGHER INITIAL PURCHASE PRICE, BUT THE RETURNS WILL START ALMOST IMMEDIATELY BECAUSE THEY OFFER WIDER FUNCTIONALITY, HIGH LEVELS OF AUTOMATION, AND ACCURACY. MAKE A POINT TO ENSURE THAT HUMANS ARE ALSO INVOLVED ON THE VENDOR SIDE. THIS IS HUGELY BENEFICIAL AS THE DATA WILL BE MORE ACCURATE, THEREFORE LESS TIME WASTED ON BUDGET AND RESOURCE-DRAINING FALSE POSITIVES.

Insight №8. Future Plans

Most businesses see enough value in their legacy ASM solution to justify using it, but many enterprises recognize they need a better solution. While 51% have no plans to stop working with their ASM vendor in the next 12 months, 27.9% say they plan to terminate their current ASM vendor with no intentions of replacing them.

PRO TIP: IT’S CLEAR THAT LEGACY ASM HAS FAILED TO MEET THE MINIMUM EXPECTATIONS OF BUYERS AND USERS. AS A BUYER, YOU NEED TO BE AWARE THAT THE NEXT GENERATION OF ASM PLATFORMS HAVE ALREADY EMERGED, REFERRED TO AS ASM 2.0. THESE NEW GEN PLATFORMS RESOLVE MANY OF THE CHALLENGES CUSTOMERS FACE, SO IT IS VITAL TO ASSESS A NEW OR EXISTING ASM PLATFORM ON THE BASIS

Conclusion

Our survey results show a widespread and immediate need for change. ASM must help, not hinder, organizations in managing digital asset risks across the entire attack surface. Still, many organizations are so frustrated with their current ASM that they’re considering abandoning it altogether.

Our survey reveals legacy ASM tools are challenging to use, expensive to operationalize, and need further integrations to gain fractional advantages over a static report. But abandoning an ASM altogether will send organizations backward, not forwards. The positive news is the future of ASM is already available in the form of ASM 2.0

ASM 2.0 seamlessly blends asset discovery, vulnerability management, cloud application management, threat intelligence, and business risk management — gone are single-function low-value platforms.

SOCs gain real-time verified and validated alerts to risks and threats affecting their assets. With ASM 2.0, patching external assets in order of priority can be in lockstep with organizational goals. Additionally, shadow IT challenges are quickly discovered, assessed for impact, and risks addressed with a complete inventory of cloud-based web applications, including the IP addresses they reside on, providing laser focus for any cloud security team.

To avoid falling into legacy ASM traps triggered by your peers and to gain deeper insights into how an ASM 2.0 solution can address the deficiencies of your current ASM, download the full report here.