Why finding more assets is not the goal of attack surface management

Why do vendors lead with asset counts?

Because they are easy to show. A discovery run that returns more hosts than the customer's own list looks like proof of value in the first week. Vendors publish figures to match: IONIX states it finds 30% to 50% more assets, and CyCognito states up to 20 times more exposures. Each figure is the vendor's own, measured against its own baseline. We report them as claims and do not score them.

What is wrong with counting assets?

Three things.

1. Counts are not comparable. One tool counts a host, another a host and port pair, a third a web application. The same estate produces different numbers in each.
2. A larger inventory can mean a larger backlog. Every new asset needs an owner and a decision. If the program cannot absorb them, discovery makes the queue longer without making anything safer.
3. Counts reward noise. Assets attributed to you by mistake inflate the number and waste the time of whoever has to rule them out.

What changes when the queue grows anyway?

The number of published vulnerabilities keeps rising. In June 2026 FIRST raised its forecast for the year to about 66,000 CVEs, and noted that when filtered for real-world risk, such as CISA KEV entries or EPSS scores above 10%, the patching burden had not materially increased. That is the argument for proof in one sentence: the raw queue grows, the part that matters grows much more slowly, and the job is to find that part fast.

What should you count instead?

Count outcomes along the six steps from lesson 1:

• Attributed: the share of new assets with an owner within a set number of days.
• Proven: the number of exposures confirmed exploitable, and the share of findings that were ruled out.
• Contained: the number of proven exposures with a compensating control in place, and how quickly it went in.
• Fixed and rechecked: the number closed with a passing retest, and the age of the oldest open proven exposure.

None of these needs a vendor's claim. All of them can be read from the tool you run, if it documents the step.

Does discovery still matter?

Yes. You cannot prove or fix what you never found, which is why discovery carries 15% of our weights. But discovery is the first step, not the score. A tool that finds a little less and proves, contains and rechecks much more is the better buy for most enterprise teams. The exposure triage calculator lets you test that trade with your own weights.