[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMlHgUv9hldCtA32dapMq4AjLUlEB4m9x76oydhJnIjg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":18,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":45,"controls":46},"dd16e95d-4be3-44a1-a2af-cc3edd4197ed","expanding-attack-surface-requires-a-proactive-risk-operations-model","8f5e755c-f9bd-4d07-9b40-830f79fe9160","Expanding Attack Surface Requires a Proactive Risk Operations Model","Organizations are struggling to reduce enterprise risk faster than adversaries — now supercharged by AI — can exploit newly discovered vulnerabilities. The attack surface has grown far beyond traditional IT into mobile, OT, and IoT environments, many of which lack mature security controls or visibility. Without a unified, proactive system for tracking and remediating risk across all asset types, security teams are perpetually reactive. The Risk Operations Center (ROC) concept addresses this by consolidating risk intelligence, remediation workflows, and cross-domain expertise into a single operating model. Failure to evolve beyond siloed, IT-centric security programs leaves critical gaps that adversaries are actively mapping and exploiting.","**Immediate actions:**\n- Conduct a comprehensive asset discovery exercise to inventory all IT, OT, IoT, and mobile assets and their associated risk exposure.\n- Deploy automated vulnerability scanning tools that cover non-traditional assets such as industrial control systems and connected devices.\n\n**Long-term improvements:**\n- Establish a Risk Operations Center (ROC) or equivalent function that unifies vulnerability intelligence, remediation tracking, and cross-domain risk reporting.\n- Implement network segmentation to isolate OT and IoT environments from corporate IT networks, limiting lateral movement opportunities for attackers.\n- Define and enforce SLA-based remediation timelines tied to asset criticality and vulnerability severity to outpace adversarial exploitation windows.\n\n**Detection measures:**\n- Integrate continuous attack surface monitoring tools that provide real-time visibility into newly exposed assets and emerging vulnerabilities.\n- Establish KPIs for mean time to remediate (MTTR) across all asset classes and report them to executive leadership to drive accountability.",[12,13,14,15,16,17,15],"CIS Control 7: Continuous Vulnerability Management","CIS Control 1: Inventory and Control of Enterprise Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":19,"NIST SP 800-53 SI-2: Flaw Remediation":20,"CIS Control 7: Continuous Vulnerability Management":21,"CIS Control 1: Inventory and Control of Enterprise Assets":22,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":23,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":24},"NIS2 mandates that essential and important entities implement risk-handling measures including vulnerability management and incident handling, reinforcing the need for the unified, proactive operating model described in the article.","NIST SI-2 requires organizations to identify, report, and correct information system flaws on defined timelines, directly countering the AI-accelerated exploitation window described in the article.","The article's core problem — adversaries exploiting vulnerabilities faster than organizations can patch — is exactly what CIS Control 7 addresses by mandating continuous scanning and time-bound remediation across all enterprise assets.","The expanding attack surface into OT, IoT, and mobile cannot be managed without first knowing what assets exist; CIS Control 1 requires a complete, up-to-date inventory as the foundation of any risk reduction program.","ISO\u002FIEC 27001:2022 A.8.8 requires organizations to systematically manage technical vulnerabilities across their entire information asset landscape, aligning directly with the ROC model proposed in the article.","Expanding into OT and IoT environments requires identity and access controls tailored to constrained devices; the CSF Protect function provides governance guidance to ensure these environments are not left as unmanaged entry points.","published","2026-11-09T14:20:21.407001+00:00","2026-11-09T14:20:21.381+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fblog.qualys.com\u002Fqualys-insights\u002F2026\u002F11\u002F09\u002Fthe-expanding-attack-surface-demands-a-new-operating-model","the-expanding-attack-surface-demands-a-new-operating-model-af8c23","The Expanding Attack Surface Demands a New Operating Model",[33,39],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[]]