Domains, subdomains, exposed services, IPs, fourth-party hops. Discovered and fingerprinted on a weekly rescan of every vendor, then watched nightly for material change — the way an attacker would see them, not the way the vendor self-reports them.
An organisation's attack surface is everything of theirs an attacker can reach from the internet: domains and subdomains, IP ranges, exposed services and ports, cloud storage, login portals, APIs, certificates and the software versions running behind all of it. Attack surface management is the practice of discovering that continuously — because the surface changes without anyone announcing it — and reducing what should not be exposed.
Vendor attack surface management applies the same method to the organisations you depend on. The reasoning is that your exposure does not stop at your own perimeter: a supplier's forgotten staging environment, expired-but-live subdomain or unpatched edge appliance is a route into data you are accountable for, and you will not find it in their questionnaire because they have usually forgotten it too.
It matters most for the assets nobody is maintaining. Discovery routinely surfaces infrastructure the vendor's own security team cannot account for — the output of an acquisition, a contractor's project, a migration that left the old host running. For the discipline in general see our attack surface management page and EASM explainer.
Most attack-surface programmes track what the vendor told you about. The actual attack surface — shadow assets, forgotten subdomains, exposed admin panels — sits outside that list.
Attack-surface mapping is REX's core remit. ARIA verifies what's exposed against what the vendor's documents claim. TARA tiers the findings and routes the urgent ones into remediation.
The outside-in scanner, on a cadence you can state. REX maps every vendor's external footprint and fingerprints exposed services on a weekly rescan, and its Continuous Monitoring sub-agent checks nightly for new assets, material change and new breaches.
External findings, validated against the vendor's own claims. ARIA cross-checks REX's discoveries against the vendor's trust centre, SOC 2 and policies — flagging where reality and self-attestation diverge.
Findings tiered by impact, not alphabet. TARA classifies every exposure by inherent risk and assigns SLA-bound remediation — so a Critical-tier vendor's exposed RDP doesn't queue behind a Low-tier banner grab.
Concrete differences in how the team works the surface — not aspirational outcomes, just a more honest map of what an attacker can actually see.
Forgotten subdomains, dev environments and old VPN endpoints surface in REX before they surface in an incident.
What the vendor says they have is verified against what's actually reachable. ARIA flags the gap.
TARA tiers exposures by impact so your team works Critical first — not whichever scan finished last.
REX maps the vendors of your vendors. The hop you didn't know about stops being a hop you can't see.
Within two weeks REX surfaced four exposed admin panels across our top-twenty vendors that nobody — including the vendors — knew were live. That's the attack surface you actually need to see.
Discovery, attribution, and how vendor attack surface differs from your own.
Book a 30-minute call and we'll have NOVA, ARIA and REX produce a complete posture report on one of your live vendors inside 24 hours.