External Attack Surface: What Recent Data Reveals About How Attacks Begin

In the previous article, we looked at an organization from the perspective of someone on the outside — an adversary.

Before launching an attack, an adversary can research domains, subdomains, applications, APIs, IP addresses, services, technologies, and other Internet-accessible assets. Gradually, they build a map of the organization’s attack surface and look for opportunities.

But how significant is this process in real-world attacks?

Data published in 2026 by some of the leading cybersecurity research and incident response organizations helps answer that question.

Although each study uses its own methodology and dataset, a consistent trend emerges: the exploitation of vulnerabilities and Internet-accessible systems continues to play a central role in the early stages of cyberattacks.

When a vulnerability becomes an entry point

The 2026 Verizon Data Breach Investigations Report (DBIR) revealed an important shift.

For the first time in the report’s 19-year history, vulnerability exploitation surpassed the use of stolen credentials as the leading entry point in the breaches analyzed.

Vulnerability exploitation was involved in the initial access of 31% of breaches, while credential abuse accounted for 13%.[1]

Mandiant’s M-Trends 2026 presents a similar picture based on the company’s investigations. Drawing on more than 500,000 hours of incident investigations conducted in 2025, the report found that exploits were the most frequently observed initial infection vector for the sixth consecutive year, accounting for 32% of investigated intrusions.[2]

Meanwhile, IBM X-Force, analyzing its 2025 incident response and investigation data, identified a 44% year-over-year increase in the exploitation of public-facing applications as an initial access vector.[3]

The datasets and methodologies differ, but the findings converge on an important point: what is externally accessible is providing concrete opportunities for intrusions to begin.

The problem lies in the combination of exposure and opportunity

A vulnerability in an internal, isolated system does not present the same scenario as a vulnerability in an application directly accessible from the Internet.

When a system is publicly accessible, it can also be discovered, analyzed, and tested by third parties.

And this is not limited to websites.

The external attack surface can include:

• Web applications and APIs.
• VPNs and other remote access services.
• Firewalls, gateways, and edge devices.
• Administrative interfaces and sensitive services.
• Legacy systems that remain online.
• Development or testing environments.
• Cloud infrastructure and services.
• Unknown or forgotten assets.

Each of these elements may contain vulnerabilities, misconfigurations, outdated software, or services that should not be accessible in their current form.

It is precisely this combination of accessible asset + existing exposure + potential for exploitation that can turn a technical issue into a real opportunity for an attacker.

Edge systems are particularly close to the attacker

Systems positioned at the edge of the infrastructure have an important characteristic: by design, many of them need to be externally accessible.

VPNs, gateways, security appliances, network devices, and other edge systems often serve the specific purpose of connecting internal environments to external networks.

This also places them directly within an attacker’s field of view.

M-Trends 2026 highlights the exploitation of zero-day vulnerabilities in edge devices and points to another challenge: these devices often lack the same level of telemetry available on traditional endpoints, which can make malicious activity more difficult to detect.[2]

Mandiant’s recommendation is explicit: organizations should aggressively manage their Internet-exposed attack surfaces, prioritizing rapid patching, vulnerability analysis, and appropriate isolation of external-facing web servers frequently targeted by campaigns involving zero-day and N-day vulnerabilities.[2]

In other words, this is not simply about finding vulnerabilities. It is about understanding where they are and how those systems are exposed to the Internet.

The time between discovery and exploitation matters

There is another important component in this equation: time.

When a vulnerability is disclosed, an organization needs to determine whether it uses the affected technology, identify the corresponding assets, understand which ones are exposed, and remediate the issue or implement compensating controls.

The attacker works in the opposite direction.

They can quickly search for vulnerable systems accessible from the Internet and attempt to exploit them before remediation takes place.

The 2026 DBIR illustrates the scale of this challenge. Among the critical vulnerabilities considered in the report — based on CISA’s Known Exploited Vulnerabilities (KEV) catalog — only 26% were fully remediated by organizations in 2025. The previous year, that figure was 38%.[1]

The time required for full remediation also increased, from 32 to 43 days.[1]

This creates an important window between three moments:

• The vulnerability becomes known or begins to be exploited.
• Attackers start searching for affected systems.
• The organization identifies and remediates its exposed assets.

The longer this window remains open, the greater the potential opportunity for exploitation.

Not every exploit requires authentication

Another data point helps explain why publicly accessible systems deserve particular attention.

The IBM X-Force Threat Intelligence Index 2026 found that 56% of the disclosed vulnerabilities analyzed did not require authentication for successful exploitation.[3]

This means that, in many cases, an attacker does not need to begin by obtaining a username and password.

If the vulnerable system is accessible and the conditions required for exploitation are present, the exposure itself can provide the initial opportunity.

IBM also links the observed increase in the exploitation of public-facing applications to gaps in basic security controls, including missing authentication controls and faster vulnerability discovery.

In this scenario, quickly identifying what is externally accessible and what exposures exist across those assets becomes directly relevant to reducing the window of opportunity available to an attacker.

And it is not just about vulnerabilities

When we talk about the external attack surface, limiting the analysis to known CVEs provides only part of the picture.

An attacker may also look for:

• Exposed administrative services.
• Misconfigurations.
• APIs published without the expected controls.
• Improperly exposed cloud storage.
• Exposed API keys and secrets.
• Leaked credentials.
• Sensitive documents publicly available.
• Systems and environments the organization itself is no longer monitoring.

None of these elements necessarily begins with a traditional software vulnerability.

What they have in common is something else: they can be discovered from an external perspective and used to expand the range of attack opportunities.

For this reason, looking only at known vulnerabilities does not necessarily mean seeing the full extent of an organization’s exposure.

The data tells a consistent story

The same pattern also appears in European data.

In its Threat Landscape 2026, ENISA states that exploitation of N-day and zero-day vulnerabilities remains a prevalent intrusion vector. Among unauthorized-access incidents for which the agency was able to determine the intrusion vector, 60% involved vulnerability exploitation.[4]

ENISA also highlights a broader issue: digital dependencies and increasingly interconnected environments are expanding organizations’ attack surfaces.[4]

When we look at these studies side by side, we do not need to turn their percentages into a single metric to see the direction:

Verizon: 31% of the analyzed breaches began with vulnerability exploitation.[1]

Mandiant: exploits were the most frequently observed initial infection vector for the sixth consecutive year, accounting for 32% of investigated intrusions.[2]

IBM X-Force: a 44% increase in the exploitation of public-facing applications as an initial access vector.[3]

ENISA: exploitation of N-day and zero-day vulnerabilities remains a prevalent intrusion vector.[4]

These are different perspectives on the same operational challenge: externally accessible systems continue to be used by attackers to identify opportunities and initiate intrusions.

The external attack surface is constantly changing

There is, however, an additional challenge.

An organization’s attack surface does not remain the same.

New applications go into production. Cloud environments are created. APIs are published. Subdomains appear. Services are enabled. Vendors connect new systems. Configurations change.

At the same time, new vulnerabilities are disclosed and new exploitation techniques become available.

An asset that did not represent a significant exposure yesterday may represent one today.

And a system that the security team believes has been decommissioned may still remain externally accessible.

For this reason, understanding the external attack surface cannot be a snapshot taken at a single point in time.

It needs to be a continuous capability.

The question is no longer simply, “Do we have vulnerabilities?”

Recent data reinforces the fact that vulnerabilities and publicly accessible systems continue to play an important role in the early stages of real-world attacks.

But it also points to a broader issue.

It is not enough to ask:

“Which vulnerabilities do we know about?”

We also need to ask:

“Which assets are actually exposed?”

“What has changed since the last assessment?”

“Are there systems that are not in our inventory?”

“What exposures can someone looking from the outside discover?”

And perhaps the most important question:

“Can we discover these changes before they become an opportunity for an attacker?”

It is from this need — to continuously discover, monitor, and understand the external attack surface — that we begin to enter the next topic in this series: Attack Surface Management (ASM/EASM).

References

1. Verizon — 2026 Data Breach Investigations Report (DBIR)
2. Google Cloud / Mandiant — M-Trends 2026 Report: Executive Edition
3. IBM X-Force — Threat Intelligence Index 2026
4. European Union Agency for Cybersecurity (ENISA) — ENISA Threat Landscape 2026

Continue exploring

• How Does a Cyberattack Begin?
• Attack Surface Management (ASM): Seeing the Organization from an Attacker’s Perspective
• External attack surface: 7 blind spots that increase exposure
• What is an attack surface and why does it change continuously?

Want to bring this perspective to your attack surface?

See how Lion Focus helps discover, monitor, validate, and prioritize cyber exposures.

Request a Demo →