Attack Surface Management for Cyber Risk Reduction

The Attack Surface Management category covers products that look at an organization the way an attacker would, from the internet. Typical entries discover domains, IP addresses, cloud services, websites and exposed services, including ones set up without the security team's knowledge, show evidence that each one belongs to the organization, test them for weaknesses and alert when something new appears. Many are sold as external attack surface management (EASM).

Building an inventory from inside, using data from existing tools, fits Cyber Asset Attack Surface Management (CAASM). Monitoring the wider web for impersonation and leaked data fits Digital Risk Protection (DRP). Attack surface products can add a second entry in Cyber Exposure Management. If the product also tests whether those exposures can be used in an attack, Adversarial Exposure Validation (AEV) is open to it as well.

Related categories to enter

Each category is judged separately, so you can enter a product in every category that matches what it does, with a separate nomination for each. Tailor each nomination to that category's focus. Entering several related categories gives the product more than one chance to be recognized.

Cyber Asset Attack Surface Management (CAASM) — for the inside-out asset inventory
Digital Risk Protection (DRP) — for impersonation and leaks beyond owned assets
Adversarial Exposure Validation (AEV) — for proving which exposures can be exploited
Vulnerability Management or Risk-Based Vulnerability Management — for scanning and ranking vulnerabilities on known assets
Third Party Risk Management (TPRM) — for the attack surface of suppliers
Cyber Exposure Management — to compete with platforms covering every kind of exposure

How entries are judged

An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against organizations of similar size and region, so a mid-sized firm is not ranked against a global enterprise. Your entry package, any sponsorship and public votes do not affect the jury's scores.

Strong entries in this category show:

Leadership — the reach of the discovery: assets found and monitored, organizations and subsidiaries mapped, and customers that rely on it for their external view.
Innovation — a discovery problem solved in a new way, such as finding assets that no inventory listed, attributing them accurately, or spotting a new exposure within hours.
Impact — results for customers: unknown assets found, exposed services closed, time from exposure to fix. Give figures from customers.

The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.

How to enter

A vendor can enter its own product or service, and a PR agency can enter it on a client's behalf. The nomination form has a confidential field for detail that is shared with the judges and not published, such as customer names, deployment figures or roadmap. Deadlines, pricing and entry steps are on the How it Works page.