FIELD NOTES · UPDATED 29 SEPTEMBER 2026
Quick answer
Longer notes for teams that run or buy attack surface management tools. Each one is dated, written from public standards pages and vendor documentation, and lists its sources.
· Standards · Prioritization
What CISA's Known Exploited Vulnerabilities catalog is, what BOD 22-01 requires, and how to work KEV matches on internet-facing assets.
Attack Surface Ranked analysts · 3 min read
· Prioritization · Standards
What CVSS, EPSS and KEV each tell you, and the order to work an external exposure list.
Attack Surface Ranked analysts · 4 min read
· News analysis
What ASM vendors announced from February to September 2026, grouped by theme, with a source for each item.
Attack Surface Ranked analysts · 3 min read
· Standards · News analysis
FIRST's forecasts, why volume hits external exposure programs hardest, and what vendors announced in 2026.
Attack Surface Ranked analysts · 3 min read
· Buying · Pricing
What each of the nine vendors we score publishes about price, the pricing bases in use, and what to ask for in a quote.
Attack Surface Ranked analysts · 3 min read
· Remediation · WAF
Which ASM tools document WAF rules and automated mitigation, and the approvals to put around them.
Attack Surface Ranked analysts · 3 min read
· Remediation · Discovery
How forgotten DNS records, expired domains and abandoned cloud buckets become takeovers, and what ASM tools document about them.
Attack Surface Ranked analysts · 3 min read
· Buying
Common beliefs about attack surface management tools, checked against what vendors actually document.
Attack Surface Ranked analysts · 3 min read