Looking the Right Way: Why More Security Tools Don’t Always Improve External Visibility
Published
Key Takeaways
- Most non-tech leaders are not aware of how the domain, IP, and port system of digital routing works.
- Tools that attempt to autonomously detect external attack surfaces fail to provide a complete picture.
- Slusser notes that domain registration, IP ownership, and cloud asset alignment are often insufficiently validated.
- According to the 2024 Verizon and Google reporting, breaches through external vulns increased 100%.
- SixMap says legacy scanning technologies were designed for smaller networks and struggle at enterprise scale.
We spoke with Larry Slusser, Vice President of Strategy at SixMap, about how security gaps emerge during mergers, acquisitions, and rapid organizational growth due to overlooked external infrastructure.
Slusser said growth and restructuring often amplify blind spots, as teams assume external-facing tasks are complete without validating actual execution. He noted that legacy scanning technologies, originally designed for smaller networks, struggle to scale accurately in modern enterprise environments, generating excessive noise without improving clarity.
While leadership typically plans network integration at a strategic level, Slusser explained that ownership of domains, IP ranges, and cloud assets is frequently overlooked.Â
Slusser, a former Air Force officer, brings experience in incident response and cyber risk management, with a background spanning vulnerability monitoring, ransomware mitigation, and operational security strategy.
Vishwa: In complex environments shaped by M&A or spinouts, what critical security questions do teams often fail to ask? This includes dormant assets, legacy routing, and unknown ownership. What tends to get overlooked?
Larry: In most cases of acquisition or divestiture, security leadership asks the right strategic questions.
- How will the networks be merged or diverged? Â
- What are the specific hardware devices and software involved? Â
However, details such as domain registration, IP block ownership, and cloud asset alignment are rarely looked at in the depth they need to be in order to ensure quality cybersecurity practices are enacted.Â
Vishwa: Asset discovery often extends into third-party or unregistered ranges. How do you judge whether a discovery method is reliable in that context? What signals or outcomes help you decide it's trustworthy?
Larry: Typically, asset discovery methodologies are automated using DNS lookups and Whois, with cross-referencing with IPs and Domains. The challenge with this standard practice is it’s often inaccurate leading companies who conduct e verbal scans to have an attribution problem.Â
Even as they fail to properly attribute domains and IPs in the proper hierarchical structure, their data is inaccurate, returning significant “false positives” or mislabeling ownership and connectivity of IP addresses and domains.
Vishwa: Many orgs prefer agentless tools for speed and simplicity. What risks come with that approach when mapping external environments? Where have you seen it fall short?
Larry: Tools that attempt to autonomously detect an organization’s external attack surface fail to provide a complete picture. This is how threat actors continue to succeed, taking advantage of externally facing vulnerabilities.Â
According to the 2024 Verizon and Google (Mandiant) cyber reporting, breaches through external vulns increased 100%. Â
This is despite the plethora of vulnerability management and attack surface SaaS cybersecurity tools available at the time.Â
Vishwa: Security leaders often struggle to connect risk insights to business action. What helps translate exposure data into decisions that leadership can actually use? Especially when the data isn't dramatic but still urgent.
Larry: Current external exposure data provided by ASM, EASM, and Vulnerability scanning companies isn’t creating urgency, as cybersecurity teams are overwhelmed with cyber tools and data. Â
How is “another tool” that says the same thing as everyone else going to save the day, hypothetically? Real-world examples need to be provided with context to demonstrate value.Â
Vishwa: During fast growth or restructuring, where do teams most often misread the risk in exposed infrastructure? What assumptions tend to cause blind spots?
Larry:Â In the movie Gladiator, the hero Maximus escapes elimination at the perimeter, yet the Roman Army reports to the Emperor that the task was completed.Â
In the same way, technical leadership is blind to the actual completion of critical external-facing tasks that can leave an organization susceptible to cyber attacks. This happens every week, yet leaders continue to not have systems and tooling to provide the maximum visibility possible.
Vishwa: In decentralized and hybrid networks, blind spots are common. What infrastructure gets missed most often in these types of environments? And what makes those assets hard to track?
Larry: Devices get spun up and attached to IPs every day without notifying the security team. Many organizations have no double-check for this possibility. Â
A rogue firewall, load balance, or misconfigured cloud asset can easily lead to a breach. Particularly if they are spun up on an unusual port that isn’t checked or scanned often. Â
Most non-tech leaders are not aware of how the domain, IP, and port system of digital routing works and are surprised to find their teams have not used accepted standards for hooking into the internet.Â
Vishwa: What types of security measures or tools do you consider essential when defending against exposure-related threats? Which ones help maintain coverage even as environments shift?
Larry: Top-level scanning technologies used by the main companies for external-facing views are based on 30-year-old technology that was designed for small networks. The scanners have been adapted and forced to brute force scan all available IPs to provide exposure data. Â
The data is rife with misattributions and errors, and large companies have tremendous overhead trying to make sense of the data. The company SixMap starts with the entity first, then maps upward from the ground up, avoiding all the noise created by traditional scanning methods.Â
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular