Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Enterprise Security Teams Are Adopting Cyber Asset Attack Surface Management
Transcript
- Lucas: A few months ago, I was talking to the CISO of a midsize manufacturer — about 20,000 employees, decent security budget. He told me his team had just run a comprehensive asset discovery exercise. They found that the company had about 8,000 more assets connected to their network than anyone had recorded. That's not a typo — eight thousand unknown servers, cloud instances, IoT devices, even an old database server sitting on a public IP that nobody had decommissioned. Luna: Eight thousand. That's almost a third of their total footprint. How do you defend something you don't know exists? Lucas: Right, and that's the exact problem that's driving one of the fastest-growing categories in enterprise security right now. It's called CAASM — Cyber Asset Attack Surface Management. The acronym is a mouthful, but the concept is simple: you can't protect what you can't see. Luna: So CAASM is basically a tool that gives you a complete inventory of everything on your network — and I mean everything, including cloud instances, SaaS apps, containers, even devices that IT never provisioned. Lucas: Exactly. And the 'attack surface' part is key — it's not just a spreadsheet of assets. It maps connections, identifies exposed services, and tells you which assets have vulnerabilities or misconfigurations. The idea is to give security teams a single pane of glass covering the entire digital estate. Luna: And why now? Companies have been doing asset management for decades. What changed? Lucas: Good question. Two things. First, the explosion of cloud and remote work has made the traditional asset inventory — spreadsheets, CMDBs, even some enterprise tools — basically useless. The average organization now has assets in AWS, Azure, GCP, plus SaaS apps, employee laptops connecting from home, contractors with their own devices. A static list updated once a quarter can't keep up. Luna: And the second thing? Lucas: Second: attackers are getting faster. The typical time from an asset being exposed to being compromised is measured in hours or minutes, not days. If you don't know about a misconfigured S3 bucket or an unpatched server within the first few hours, you've already lost. CAASM platforms continuously scan and update, so you get near real time visibility. Luna: That manufacturer you mentioned — what happened after they found those 8,000 unknown assets? Lucas: They prioritized the critical ones. That legacy database on a public IP was full of production data — customer records, schematics. They took it offline within four hours. Before CAASM, their average time to detect and remediate an exposed service was about 18 days. After deploying the platform, they got that down to under four hours for critical findings. Luna: Four hours from 18 days. That's a massive improvement. And I assume they didn't just find the database — they probably discovered a lot of shadow IT, right? Lucas: Absolutely. Shadow IT is one of the biggest drivers. Teams spin up cloud instances for a project, forget to shut them down, or employees sign up for SaaS tools without telling IT. CAASM platforms can connect to cloud APIs, directory services, and network scanners to find all of that automatically. Luna: So how does CAASM differ from traditional vulnerability scanners? Isn't that what Qualys and Tenable do? Lucas: They overlap, but the focus is different. Vulnerability scanners assume you already have an asset list — they scan what you tell them to scan. CAASM is about discovery first: finding everything, including things you didn't know about. Then it can feed that inventory into vulnerability scanners, EDR tools, firewalls — it's an integration layer. Luna: So it's more of a data aggregation and correlation platform than a point scanner. Lucas: Exactly. Gartner actually defines CAASM as a category that 'provides asset discovery, analysis, and remediation workflows through API integrations with existing security and IT tools.' The key phrase is 'through API integrations' — it's not replacing your existing tools, it's connecting them. Luna: And Gartner has been talking about this a lot. I remember their report from last year predicted that by 2027, 30% of large enterprises would adopt CAASM. That's up from maybe 5% today. Lucas: Right. And the market is responding. There are several companies in this space — Axonius, JupiterOne, Censys, and some startups like Sevco Security. Axonius is probably the most established; they raised over $400 million and have hundreds of enterprise customers. Their approach is to connect to whatever tools you already have — Active Directory, cloud consoles, endpoint agents — and build a unified asset graph. Luna: An asset graph — that's a term I've heard a lot. What does that actually look like in practice? Lucas: It's a visual map of every asset and the relationships between them. So you can see, for example, that a specific EC2 instance is running an outdated version of OpenSSL, it's connected to a load balancer that's exposed to the internet, and it's accessed by a service account that has admin privileges. That's a risk chain that you might never spot looking at separate data sources. Luna: And that's the kind of insight that helps a security team prioritize. Instead of hundreds of alerts, you see the few critical paths that could actually lead to a breach. Lucas: Precisely. One of the challenges with traditional security operations is alert fatigue — you get so many findings from different tools that you don't know which ones matter. CAASM helps by correlating assets with vulnerabilities and exposures, so you can focus on the ones that are both critical and actually reachable. Luna: Let's talk about a concrete example. I read a case study about a financial services firm that deployed JupiterOne — they had over 100,000 assets across multiple clouds and on-prem. Before CAASM, they spent weeks manually reconciling asset lists. After, they had a complete inventory in under 24 hours. Lucas: That's the kind of ROI that gets a CISO budget approval. But the real value is ongoing. Once you have that continuous visibility, you can automate remediation workflows. For example, if a new asset appears that doesn't meet your security baseline — say it's missing an endpoint agent — you can automatically quarantine it or trigger a ticket. Luna: And that moves security from a reactive function to something more proactive. You're not just waiting for alerts; you're enforcing policies as assets are created. Lucas: Exactly. And that's where the future of the category is heading. The early adopters are large enterprises with complex environments, but we're starting to see mid-market companies pick it up too. The pricing has come down, and some vendors offer cloud-only versions that are easier to deploy. Luna: What about the challenges? I imagine integrating with dozens of different APIs isn't trivial. Lucas: That's the biggest hurdle. Every environment is different — you might have legacy systems that don't have APIs, or you might need specific permissions to access certain cloud services. Also, the asset graph is only as good as the data you feed it. If your cloud accounts aren't fully connected, you'll miss assets. So deployment requires careful planning. Luna: But once it's set up, it becomes a foundational layer. I've heard CISOs describe it as 'the single source of truth' for the security program. Lucas: Yeah, that's the ideal. And it connects to broader trends like cyber asset management and attack surface reduction. Some vendors are even adding external attack surface management to find assets that are outside your direct control — like brand impersonation domains or third-party services that expose your data. Luna: So CAASM plus EASM — the internal and external view together. That's a powerful combination. Lucas: It is. And I think we'll see more convergence between those categories over the next couple of years. But for now, the immediate win for most organizations is simply knowing what they have. That CISO I mentioned earlier told me that after the initial discovery, his team felt like they were finally in control for the first time in years. Luna: And listeners, if you've ever had that feeling of not knowing what's on your network, or if you're evaluating tools to get a handle on your asset inventory, this episode hopefully gave you a solid starting point. We'll keep tracking this space as it evolves. Lucas: And we aim to keep these conversations useful and ad-free. If you find value in that approach, supporting the show at buy me a coffee dot com slash fexingo helps us keep it that way. Luna: Yeah, it's a simple way to help us keep doing what we do, without any sponsorship noise. Lucas: So the bottom line on CAASM: if you don't have a complete, continuously updated asset inventory, you're flying blind. The tools exist. The ROI is clear. And the attackers aren't waiting. Luna: Thanks for listening, and we'll catch you next time.