The ROI Problem in Attack Surface Management

Attack Surface Management tools promise reduced risk, but the article argues that the ROI question is often left unanswered as asset counts rise without clear evidence of risk reduction. According to The Hacker News, the gap lies in measuring inputs such as asset discovery and changes rather than actual outcomes that make organisations safer.

It identifies three outcome metrics that matter: Mean Time to Asset Ownership, which measures how quickly ownership is established; reductions in unauthenticated, state-changing endpoints, which indicate where exposure actually shrinks; and Time to Decommission After Ownership Loss, reflecting long‑term hygiene when ownership is lost.

The piece also notes that disclosure metrics can be misleading when they fail to show whether risk is decreasing, and it advocates reframing ROI from asset inventory to how fast and how safely exposure is handled. The article, written by Topher Lyons of Sprocket Security, was published on 2 January 2026 and concludes that ROI only proves itself when risky assets are owned faster, dangerous paths disappear, and abandoned infrastructure is retired promptly.