Attack Surface Management Statistics 2026: Unknown Assets, Exposure & Risk

Executive Benchmark: Attack Surface Management Statistics for 2026

Methodology: What Counts as an Attack Surface?

“Attack surface management statistics” is used for five different measurements. Each answers a different question, comes from a different kind of source, and can be wrong in a different way.

Source confidence. Verizon’s DBIR is a contributed incident corpus. Mandiant’s M-Trends reports its own investigations. Everything attributed to Palo Alto Networks, Censys, GitGuardian, CrowdStrike and Unit 42 is vendor research, which describes that vendor’s scanning or customers. The HostingChecker study is peer-reviewed but covers 2021 and 2022. There is no public, neutral count of how many internet-facing assets an average organization has, so this report does not give one.

Counting rules used here. Every figure carries its period. Asset counts are never converted into vulnerability or breach counts. Where the same ecosystem is counted by two sources, both are shown with their definitions.

How Big Is the Unknown Attack Surface?

No neutral source publishes the average number of internet-facing assets per organization. What the public data shows is where services hide, and how fast new kinds of exposure appear.

Services outside the default ports

Censys’s 2026 State of the Internet found that 96% of SOCKS proxies, 68% of HTTP(S) services and 34% of SSH services run on non-standard ports. An asset list built from default port numbers misses a large share of what is exposed. Source: Censys, vendor-only.

New kinds of assets: AI and automation tools

Censys reported that hosts exposing AI-related services rose more than 63% from October 2025 to July 2026. More than 294,000 distinct IP addresses exposed at least one of 43 AI or LLM tools, up from about 183,000 in October 2025. It counted 113,926 exposed n8n hosts, 76% of them in an affected version range. Source: Censys, vendor-only.

Industrial and operational technology

Palo Alto Networks, Siemens and Idaho National Laboratory reported that fingerprinted industrial devices on the internet grew from 6 million in 2023 to 20 million in 2024, which the vendor describes as a 332% surge. Cortex Xpanse recorded more than 110 million observations of exposed OT devices in 2024, up 138%. Separately, Censys counted about 134,000 exposed industrial control systems, about 70% of them on consumer or mobile networks. Sources: Palo Alto Networks and Censys, both vendor-only.

For counts of exposed ports and services by type, see ScanTitan’s open ports statistics.

Third-Party and Vendor-Hosted Assets

Verizon’s 2026 DBIR put third-party involvement in 48% of breaches, up from 30% in the previous report, a 60% increase after the metric had already doubled the year before. Verizon counts three relationships: a vendor in the software supply chain, a vendor hosting the organization’s data, and a vendor with a connection into the organization’s environment. Breaches increasingly combine two or all three.

How long third-party exposures stay open

For the first time Verizon had data from inside third-party cloud environments, not only outside scans.

Source: Verizon 2026 DBIR, pages 20 to 22. Verizon read the lower Snowflake figure as a sign that customers responded to the 2024 credential campaign. For other cloud settings that expose assets, see common cloud misconfigurations.

Third-party involvement by industry

Source: Verizon 2026 DBIR, industry pages. Each percentage is a share of that group’s breaches in the dataset, so it is not a ranking of attack frequency. For the supply chain side, see ScanTitan’s third-party data breach statistics.

DNS and Subdomain Takeover

A dangling DNS record points a subdomain at a cloud or hosting resource that has been deleted. An attacker can claim the freed resource and serve content under the organization’s own domain. The best public measurement is the HostingChecker study, published at ACM SIGMETRICS in 2023.

Source: APNIC, unravelling the threat of hosting-based domain takeovers, summarizing the authors’ SIGMETRICS 2023 paper. The passive DNS dataset processed about 600 billion queries a day.

The figures are real but dated. They show that the problem exists at scale and that it is easy to create, not how large it is in 2026. No newer public measurement of comparable scope was found. The affected services included cloud storage, content delivery networks and website builders from large providers.

Secrets and Credentials Tied to Assets

Every exposed asset has an identity behind it, and those identities leak. GitGuardian’s 2026 report found 28.65 million new hardcoded secrets in public GitHub commits in 2025, up 34%. Secrets tied to AI services reached 1,275,105, up 81%. When it retested secrets that were valid in 2022, 64% were still valid in January 2026, down from nearly 70% in the earlier retest. Source: GitGuardian, vendor-only.

Verizon’s 2026 data shows why this matters at the perimeter. Credential abuse was the first step in 13% of breaches and appeared at any step in 39%, and use of stolen credentials was recorded in 36% of breaches. For how those figures are counted, and for infostealer and session theft data, see ScanTitan’s credential theft statistics.

Exposure Duration and Attacker Speed

An attack surface is only as risky as the time between exposure and discovery. Several sources measure different parts of that clock.

Sources: Censys, Google Cloud, M-Trends 2026, CrowdStrike, Unit 42 and the Verizon 2026 DBIR Executive Summary.

Mandiant also reported that, across all 2025 investigations, organizations first detected malicious activity internally 52% of the time, up from 43% in 2024. It singled out unmonitored edge devices, where a backdoor family reached dwell times of nearly 400 days, and noted that standard 90-day log retention leaves defenders blind to the original access.

Exposure is found in minutes, exploitation can come before a patch, and remediation takes weeks. These figures measure different events, so they cannot be subtracted from one another. For the scanning and edge device data behind the first rows, see the open ports statistics linked above, and for time to exploit across all vulnerabilities, ScanTitan’s vulnerability statistics.

Attacks Across Several Surfaces

Unit 42 tracks how many attack surfaces an intrusion touches, for example endpoint, cloud, identity and the browser. In its 2026 report, covering more than 750 cases from October 2024 to September 2025:

Source: Unit 42 2026 Global Incident Response Report, vendor-only. The sample is Unit 42’s own incident response customers, so it describes serious incidents, not all attacks.

The point for exposure management is that an attacker rarely stays on the surface where they entered. A forgotten asset on one surface can be the first step toward several others.

Attack Surface Management Statistics Commonly Misquoted

What the Numbers Mean for a Lean Team

You cannot manage what you cannot list, and the public data shows the list is always incomplete. A short order of work:

1. Start from what an outsider sees. Build the asset list from DNS, certificate and scan data, not from your CMDB. Services on non-standard ports and AI tools show up here first. ScanTitan’s internet-exposed services guide shows what an attacker can see on a public IP, and an IP vulnerability scanner tests it from outside.
2. Delete DNS records when you delete resources. Dangling records are created by deprovisioning without cleanup. Put the DNS step in the same ticket or pipeline as the teardown.
3. Ask vendors about their exposure, not their paperwork. Verizon found weak passwords and excess permissions in third-party clouds took almost eight months to fix.
4. Rotate and revoke secrets after exposure. Six in ten leaked secrets were still valid four years on.
5. Put edge devices and management planes on the monitored list. Mandiant tied dwell times of nearly 400 days to unmonitored edge devices.
6. Re-scan on a schedule. The first probe of a new service can arrive within minutes, so an annual review is too slow. ScanTitan’s attack surface management page describes continuous discovery.

How We Compiled and Verified These Statistics

• Used: Verizon’s 2026 DBIR (full report), Google Cloud’s M-Trends 2026, Palo Alto Networks and Unit 42 reports, Censys reports, the ACM SIGMETRICS HostingChecker study through APNIC’s summary, GitGuardian’s 2026 report and CrowdStrike’s 2026 Global Threat Report. Vendor figures are labeled vendor-only.
• Method: Figures were read from the primary page or report and tied to their period and unit. The Mandiant, Palo Alto OT, APNIC and Verizon figures were read on their own pages. GitGuardian, Unit 42 and CrowdStrike figures were confirmed through the vendors’ published pages and search listings.
• Excluded: Figures that could not be traced to a primary source, including claimed monthly asset growth, attack surface testing coverage, remediation half-lives and dangling record lifetimes quoted without a named report.
• Refresh: Reviewed every 90 days. Vendor reports update on their own cycles, and Verizon and Mandiant annually.

How to cite this research. ScanTitan, “Attack Surface Management Statistics 2026: Unknown Assets, Exposure & Risk,” 1 November 2026. For single figures, cite the primary source beside each number.

Primary Sources

• Verizon 2026 Data Breach Investigations Report and Executive Summary
• Google Cloud, M-Trends 2026
• Palo Alto Networks, Operational Technology and the Public Internet
• Unit 42 2026 Global Incident Response Report and report summary
• Censys 2026 State of the Internet and ICS edition
• Censys, who’s knocking on your door
• APNIC, hosting-based domain takeovers
• GitGuardian, State of Secrets Sprawl 2026
• CrowdStrike 2026 Global Threat Report
• CISA BOD 26-04

Frequently Asked Questions