[{"data":1,"prerenderedAt":459},["ShallowReactive",2],{"\u002Fblog\u002Funderstanding-your-true-attack-surface-part-one":3,"blog-all-posts":384},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"cardTitle":10,"titleLines":11,"descriptionLines":15,"bodyLeadTitle":18,"publishedAt":19,"updatedAt":19,"tags":20,"coverImage":24,"coverAlt":25,"heroLayout":26,"heroTitleSize":27,"featured":6,"draft":6,"body":28,"_type":378,"_id":379,"_source":380,"_file":381,"_stem":382,"_extension":383},"\u002Fblog\u002Funderstanding-your-true-attack-surface-part-one","blog",false,"","Understanding Your True Attack Surface: Part One","The modern attack surface extends far beyond the corporate firewall.","Understanding Your True Attack Surface Part One",[12,13,14],"Understanding Your","True Attack Surface:","Part One",[16,17],"The modern attack surface extends","far beyond the corporate firewall.","Ever Expanding and Transforming","2026-06-21",[21,22,23],"attack surface","network security","cybersecurity strategy","\u002Fblog\u002Funderstanding-your-true-attack-surface-part-one\u002Fcover.jpg","Security leader reviewing an enterprise attack surface dashboard spanning cloud, applications, remote offices, devices, patching, identities, and internet exposure","overlay","compact",{"type":29,"children":30,"toc":370},"root",[31,45,55,60,65,72,77,82,201,207,212,217,222,232,238,243,264,276,288,296,301,306,316,322,327,337,343,355,360],{"type":32,"tag":33,"props":34,"children":35},"element","p",{},[36,39],{"type":37,"value":38},"text","Many organizations underestimate the size of their true attack surface. A common misconception is that installing a firewall protects the entire company from cyberattack. While firewalls remain an important security control, ",{"type":32,"tag":40,"props":41,"children":42},"strong",{},[43],{"type":37,"value":44},"they now represent only one component of a much larger defensive strategy.",{"type":32,"tag":33,"props":46,"children":47},{},[48,50],{"type":37,"value":49},"Over the past decade, the traditional corporate network has largely disappeared. Cloud service platforms, SaaS applications, remote employees, mobile devices, APIs, Internet-connected (IoT) devices, third-party vendors, and hybrid work have expanded the number of systems exposed to attackers. ",{"type":32,"tag":40,"props":51,"children":52},{},[53],{"type":37,"value":54},"The modern attack surface extends far beyond the walls of the corporate office.",{"type":32,"tag":33,"props":56,"children":57},{},[58],{"type":37,"value":59},"In order to stay secure in today's threat environment, companies need to obtain a deeper understanding of their attack surface.",{"type":32,"tag":33,"props":61,"children":62},{},[63],{"type":37,"value":64},"It all begins with the devices we use.",{"type":32,"tag":66,"props":67,"children":69},"h2",{"id":68},"technology-the-osi-model",[70],{"type":37,"value":71},"Technology & the OSI Model",{"type":32,"tag":33,"props":73,"children":74},{},[75],{"type":37,"value":76},"Every device connected to a network communicates using standardized networking protocols. One of the best-known ways to understand these communications is the OSI Model, which divides network communication into seven logical layers. Each layer performs a specific function, from transmitting electrical signals to delivering applications like web browsing and email.",{"type":32,"tag":33,"props":78,"children":79},{},[80],{"type":37,"value":81},"The layers are as follows:",{"type":32,"tag":83,"props":84,"children":85},"table",{},[86,105],{"type":32,"tag":87,"props":88,"children":89},"thead",{},[90],{"type":32,"tag":91,"props":92,"children":93},"tr",{},[94,100],{"type":32,"tag":95,"props":96,"children":97},"th",{},[98],{"type":37,"value":99},"Layer",{"type":32,"tag":95,"props":101,"children":102},{},[103],{"type":37,"value":104},"Description",{"type":32,"tag":106,"props":107,"children":108},"tbody",{},[109,123,136,149,162,175,188],{"type":32,"tag":91,"props":110,"children":111},{},[112,118],{"type":32,"tag":113,"props":114,"children":115},"td",{},[116],{"type":37,"value":117},"Application",{"type":32,"tag":113,"props":119,"children":120},{},[121],{"type":37,"value":122},"Applications users interact with",{"type":32,"tag":91,"props":124,"children":125},{},[126,131],{"type":32,"tag":113,"props":127,"children":128},{},[129],{"type":37,"value":130},"Presentation",{"type":32,"tag":113,"props":132,"children":133},{},[134],{"type":37,"value":135},"Encrypts and formats data",{"type":32,"tag":91,"props":137,"children":138},{},[139,144],{"type":32,"tag":113,"props":140,"children":141},{},[142],{"type":37,"value":143},"Session",{"type":32,"tag":113,"props":145,"children":146},{},[147],{"type":37,"value":148},"Establishes and maintains communications",{"type":32,"tag":91,"props":150,"children":151},{},[152,157],{"type":32,"tag":113,"props":153,"children":154},{},[155],{"type":37,"value":156},"Transport",{"type":32,"tag":113,"props":158,"children":159},{},[160],{"type":37,"value":161},"Ensures reliable or fast delivery",{"type":32,"tag":91,"props":163,"children":164},{},[165,170],{"type":32,"tag":113,"props":166,"children":167},{},[168],{"type":37,"value":169},"Network",{"type":32,"tag":113,"props":171,"children":172},{},[173],{"type":37,"value":174},"Routes data between networks",{"type":32,"tag":91,"props":176,"children":177},{},[178,183],{"type":32,"tag":113,"props":179,"children":180},{},[181],{"type":37,"value":182},"Data Link",{"type":32,"tag":113,"props":184,"children":185},{},[186],{"type":37,"value":187},"Transfers data within local networks",{"type":32,"tag":91,"props":189,"children":190},{},[191,196],{"type":32,"tag":113,"props":192,"children":193},{},[194],{"type":37,"value":195},"Physical",{"type":32,"tag":113,"props":197,"children":198},{},[199],{"type":37,"value":200},"Moves electrical, optical, or wireless signals",{"type":32,"tag":66,"props":202,"children":204},{"id":203},"understanding-tcp-and-udp",[205],{"type":37,"value":206},"Understanding TCP and UDP",{"type":32,"tag":33,"props":208,"children":209},{},[210],{"type":37,"value":211},"Like the OSI Model, TCP\u002FIP and UDP are used within every mobile phone, tablet, desktop, and IoT device that's attached to the Internet.",{"type":32,"tag":33,"props":213,"children":214},{},[215],{"type":37,"value":216},"TCP provides reliable communication by ensuring data is delivered accurately and in order.",{"type":32,"tag":33,"props":218,"children":219},{},[220],{"type":37,"value":221},"UDP prioritizes speed over reliability, making it well suited for real-time communications such as voice, video, and streaming.",{"type":32,"tag":33,"props":223,"children":224},{},[225,230],{"type":32,"tag":40,"props":226,"children":227},{},[228],{"type":37,"value":229},"The TCP\u002FIP attack surface is enormous because every IP address can be probed across 65,535 TCP ports and 65,535 UDP ports.",{"type":37,"value":231}," While only a small subset is normally open, attackers can probe every port looking for accessible services, vulnerabilities, or misconfigurations.",{"type":32,"tag":66,"props":233,"children":235},{"id":234},"the-mathematics-of-the-attack-surface",[236],{"type":37,"value":237},"The Mathematics of the Attack Surface",{"type":32,"tag":33,"props":239,"children":240},{},[241],{"type":37,"value":242},"Each IP address exposes:",{"type":32,"tag":244,"props":245,"children":246},"ul",{},[247,256],{"type":32,"tag":248,"props":249,"children":250},"li",{},[251],{"type":32,"tag":40,"props":252,"children":253},{},[254],{"type":37,"value":255},"65,535 TCP ports",{"type":32,"tag":248,"props":257,"children":258},{},[259],{"type":32,"tag":40,"props":260,"children":261},{},[262],{"type":37,"value":263},"65,535 UDP ports",{"type":32,"tag":33,"props":265,"children":266},{},[267,269,274],{"type":37,"value":268},"For a total of ",{"type":32,"tag":40,"props":270,"children":271},{},[272],{"type":37,"value":273},"131,070 possible network endpoints",{"type":37,"value":275},".",{"type":32,"tag":33,"props":277,"children":278},{},[279,281,286],{"type":37,"value":280},"For an organization with ",{"type":32,"tag":40,"props":282,"children":283},{},[284],{"type":37,"value":285},"500 Internet-facing hosts",{"type":37,"value":287},", the theoretical attack surface becomes:",{"type":32,"tag":33,"props":289,"children":290},{},[291],{"type":32,"tag":40,"props":292,"children":293},{},[294],{"type":37,"value":295},"500 × 131,070 = 65,535,000 possible network endpoints",{"type":32,"tag":33,"props":297,"children":298},{},[299],{"type":37,"value":300},"Fortunately, only a small fraction are typically open.",{"type":32,"tag":33,"props":302,"children":303},{},[304],{"type":37,"value":305},"While only a small percentage of these ports typically host active services, attackers automate the discovery process. Modern vulnerability scanners and reconnaissance tools can examine millions of ports in minutes, rapidly identifying exposed services, outdated software, weak configurations, and forgotten systems.",{"type":32,"tag":33,"props":307,"children":308},{},[309,311],{"type":37,"value":310},"Network ports represent only one dimension of the attack surface. Each exposed service operates across multiple layers of the networking stack, introduces its own protocols, software, authentication methods, and configuration requirements, and may contain vulnerabilities unique to that technology. ",{"type":32,"tag":40,"props":312,"children":313},{},[314],{"type":37,"value":315},"As organizations deploy hundreds or thousands of services, the attack surface expands exponentially.",{"type":32,"tag":66,"props":317,"children":319},{"id":318},"far-more-than-ip-addresses",[320],{"type":37,"value":321},"Far More Than IP Addresses",{"type":32,"tag":33,"props":323,"children":324},{},[325],{"type":37,"value":326},"From an executive perspective, the attack surface is far more than IP addresses and ports. It includes every Internet-facing asset, cloud workload, identity, API, application, endpoint, mobile device, vendor connection, and employee that could provide an attacker with a path into the organization. Understanding what exists is the first step toward securing it.",{"type":32,"tag":33,"props":328,"children":329},{},[330,335],{"type":32,"tag":40,"props":331,"children":332},{},[333],{"type":37,"value":334},"A Fortune 500 organization may expose tens of thousands of Internet-facing assets across multiple cloud providers.",{"type":37,"value":336}," Even a mid-sized business often maintains hundreds of public IP addresses, thousands of user identities, hundreds of SaaS applications, and numerous third-party integrations. The true attack surface extends well beyond what is visible from the corporate firewall.",{"type":32,"tag":66,"props":338,"children":340},{"id":339},"part-two-internet-network-attack-surfaces",[341],{"type":37,"value":342},"Part Two: Internet & Network Attack Surfaces",{"type":32,"tag":33,"props":344,"children":345},{},[346,348,353],{"type":37,"value":347},"While network ports and protocols form the technical foundation of every connected system, ",{"type":32,"tag":40,"props":349,"children":350},{},[351],{"type":37,"value":352},"they represent only one dimension of an organization's attack surface.",{"type":37,"value":354}," In Part Two, we'll explore the Internet-facing assets that attackers actively search for, including websites, APIs, remote access services, exposed storage, DNS infrastructure, and other publicly accessible systems.",{"type":32,"tag":33,"props":356,"children":357},{},[358],{"type":37,"value":359},"These are the areas attackers increasingly target because they often provide the fastest path into an organization.",{"type":32,"tag":33,"props":361,"children":362},{},[363,368],{"type":32,"tag":40,"props":364,"children":365},{},[366],{"type":37,"value":367},"Understanding what is visible to the outside world",{"type":37,"value":369}," is the first step toward identifying and reducing the pathways attackers can exploit.",{"title":7,"searchDepth":371,"depth":371,"links":372},2,[373,374,375,376,377],{"id":68,"depth":371,"text":71},{"id":203,"depth":371,"text":206},{"id":234,"depth":371,"text":237},{"id":318,"depth":371,"text":321},{"id":339,"depth":371,"text":342},"markdown","content:blog:understanding-your-true-attack-surface-part-one.md","content","blog\u002Funderstanding-your-true-attack-surface-part-one.md","blog\u002Funderstanding-your-true-attack-surface-part-one","md",[385,395,405,416,418,426,438,449],{"_path":386,"title":387,"description":388,"cardTitle":389,"publishedAt":390,"tags":391,"coverImage":393,"coverAlt":394,"featured":6},"\u002Fblog\u002Funderstanding-your-true-attack-surface-part-two","Understanding Your True Attack Surface: Part Two","Few companies understand how they look to an attacker. Your Internet attack surface is exactly what attackers see first.","Understanding Your True Attack Surface Part Two","2026-07-28",[21,392,23],"internet security","\u002Fblog\u002Funderstanding-your-true-attack-surface-part-two\u002Fcover.jpg","Cyber operations control tower monitoring a connected city and its Internet-facing attack surface",{"_path":396,"title":397,"description":398,"publishedAt":399,"tags":400,"coverImage":403,"coverAlt":404,"featured":6},"\u002Fblog\u002Ftop-cyber-threats-facing-businesses-in-2026","Top Cyber Threats Facing Businesses in 2026","Businesses face AI-assisted hacking, interception-proxy phishing, dark web breach data, and API attacks in 2026.","2026-06-26",[401,402,23],"cyber threats","business security","\u002Fblog\u002Ftop-cyber-threats-facing-businesses-in-2026\u002Fcover.jpg","A city skyline beneath a massive storm cloud embedded with cybersecurity symbols and lightning",{"_path":406,"title":407,"description":408,"publishedAt":409,"tags":410,"coverImage":414,"coverAlt":415,"featured":6},"\u002Fblog\u002Fchallenges-facing-ai-frontier-models-part-two","Challenges Facing AI Frontier Models Part Two","Frontier AI models must overcome constraints in context, agent design, data quality, energy, and open-source competition.","2026-06-25",[411,412,413],"artificial intelligence","frontier models","AI safety","\u002Fblog\u002Fchallenges-facing-ai-frontier-models-part-two\u002Fcover.jpg","A humanoid robot ascending a snowy mountain ridge toward the sunset",{"_path":4,"title":8,"description":9,"cardTitle":10,"publishedAt":19,"tags":417,"coverImage":24,"coverAlt":25,"featured":6},[21,22,23],{"_path":419,"title":420,"description":421,"publishedAt":422,"tags":423,"coverImage":424,"coverAlt":425,"featured":6},"\u002Fblog\u002Fchallenges-facing-ai-frontier-models","Challenges Facing AI Frontier Models Part One","Frontier AI models face a series of challenges that threaten their viability","2026-06-12",[411,412,413],"\u002Fblog\u002Fchallenges-facing-ai-frontier-models\u002Fcover.jpg","A humanoid robot standing among clouds beneath a blue sky",{"_path":427,"title":428,"description":429,"cardTitle":430,"publishedAt":431,"tags":432,"coverImage":436,"coverAlt":437,"featured":6},"\u002Fblog\u002Fexecutive-operational-security-opsec-part-one-setting-the-foundation","Executive Operational Security Part One: Setting the Foundation","Executive OPSEC protects senior leaders, privileged access, sensitive information, communications, travel, and personal activity from targeted threats.","Executive Operational Security Part One","2026-06-10",[433,434,435],"executive security","OPSEC","risk management","\u002Fblog\u002Fexecutive-operational-security-opsec-part-one-setting-the-foundation\u002Fcover.jpg","Executive reviewing his phone beside a laptop in a private office",{"_path":439,"title":440,"description":441,"publishedAt":442,"tags":443,"coverImage":447,"coverAlt":448,"featured":6},"\u002Fblog\u002Fevaluating-identity-before-attackers-do","Evaluating Identity Before Attackers Do","An IAM assessment evaluates authentication, access controls, user behavior, and identity resilience before attackers can exploit them.","2026-06-07",[444,445,446],"identity security","IAM assessment","access management","\u002Fblog\u002Fevaluating-identity-before-attackers-do\u002Fcover.jpg","Open cyber vault displaying identity security controls and authentication monitoring",{"_path":450,"title":451,"description":452,"publishedAt":453,"tags":454,"coverImage":457,"coverAlt":458,"featured":6},"\u002Fblog\u002Fthe-necessity-of-an-enterprise-risk-assessment","The Necessity of an Enterprise Risk Assessment","Effective Cybersecurity is both a Technical and Procedural Endeavor","2026-05-26",[455,435,456],"enterprise risk assessment","cybersecurity governance","\u002Fblog\u002Fthe-necessity-of-an-enterprise-risk-assessment\u002Fcover.jpg","CISO in an aircraft cockpit overlooking clouds with technical and procedural cybersecurity displays",1785277054253]