The cyber risk hiding in plain sight

Date:
Wed, 29 Jul 2026 12:58:19 +0000

Description:
The modern attack surface is expanding while becoming more fragmented,
complex and harder to control.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter For all the attention given to sophisticated cyber threats and zero-day vulnerabilities, most organizations are overlooking a far more immediate danger: the risks they already know
about but havent fixed. Dan Schiappa Social Links Navigation

President of Technology and Services at Arctic Wolf. Recent research paints a sobering picture of enterprise security today. Across more than 800,000 IT assets analyzed, one in three lacks at least one critical security control. Nearly one in five is running end-of-life software and 17% sit entirely outside traditional vulnerability management tools. In other words, the
modern attack surface is not just expanding it is becoming increasingly fragmented, poorly understood and difficult to control. Latest Videos From TechRadar Watch full video here: Breaches built on the basics One of the most concerning recent developments is how little attackers need to innovate.
Every one of the top 10 most frequently exploited vulnerabilities in recent incident response cases had already been patched by vendors often months earlier.

At the same time, 65% of incidents involved the abuse of remote access services such as VPNs , RDP and remote management tools. These are not
obscure weaknesses; they are foundational components of modern IT environments. You may like Closing the security blind spots that are a prime entry point for attacks The shocking reason 43% of UK businesses have been
hit by cyber attacks last year From alert fatigue to autopilot fatigue: How agentic AI shifts cyber risk

The takeaway is clear: attackers are not outpacing defenders technologically. They are taking advantage of execution gaps. Organizations have become adept at identifying vulnerabilities, but far less effective at prioritizing and remediating them and the gap between knowing, prioritizing and fixing is
where risk accumulates. That gap is now where most breaches begin. The visibility problem At the heart of the issue lies a more fundamental challenge: visibility. Enterprise IT environments have evolved into highly distributed ecosystems, spanning on-premises infrastructure, cloud services, SaaS applications, remote endpoints and third-party integrations. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting
your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Each layer is typically managed by different tools, each maintaining its own inventory. None offers a complete view, and the result is predictable. Assets fall outside patch cycles. Devices are not covered by endpoint protection . Entire systems go unscanned. Almost a fifth (17%) of assets are now not covered by vulnerability management tools at all effectively rendering them invisible from a security standpoint.

This is not simply a technical oversight. It creates what many security leaders now recognize as a structural weakness: organizations cannot secure what they cannot see.

For UK businesses, this challenge is becoming increasingly consequential. Regulatory frameworks such as the Network and Information Systems (NIS2) Regulations and the UKs forthcoming Cyber Security and Resilience Bill are placing greater emphasis on demonstrable control over assets and risk. Inaccurate inventories and fragmented data make that more and more difficult to prove. What to read next AI-driven cyber discovery signals a new era of systemic risk for banks How attack surface management tools can help map your organization's threats and vulnerabilities Rethinking cyber defense in government with continuous exposure management Legacy systems: The risk that wont go away Compounding the visibility issue is the persistence of legacy technology. 19% of IT assets are running software or hardware that has
reached end-of-life, meaning it no longer receives security updates.

These systems are particularly challenging. In sectors such as healthcare, manufacturing and financial services, they are often embedded in critical processes and cannot be easily replaced. Yet they remain permanently exposed to known vulnerabilities.

The problem is not just their existence, but their opacity. It is not unusual for organizations to believe legacy systems have been decommissioned only to discover they were still active. This creates a persistent blind spot within the attack surface, one that attackers are quick to exploit. A growing gap between perception and reality Perhaps most concerning is the extent to which organizations misunderstand their own security posture. Many rely on a single system of record such as a configuration management tool as their source of truth. However, these systems are often incomplete.

In one example, a company believed it had full endpoint protection coverage based on internal reporting. Independent analysis revealed that a portion of its devices were not included in the system at all. This disconnect between perception and reality creates a false sense of security one that is increasingly untenable in a climate of rising regulatory scrutiny and board-level accountability.

Across the UK and EU, frameworks such as the Digital Operational Resilience Act in financial services and NIS2 more broadly are raising expectations. Organizations are no longer judged on whether controls are in place, but whether they are effective, verifiable and consistently applied. From vulnerability management to exposure management Against this backdrop, there is a broader shift in how organizations approach cybersecurity. Traditional vulnerability management, focused on identifying and scoring flaws, is no longer sufficient. The challenge is not a lack of data , but a lack of
clarity about what matters most.

Exposure management, by contrast, adopts a more holistic view. It combines continuous asset discovery with data from multiple sources, applying business and threat context to prioritize risk. Crucially, it also focuses on verification ensuring that remediation actions are actually completed.

This shift is already delivering measurable results. Organizations that adopt more mature exposure management practices see reductions of more than 40% across key risk categories, including missing controls and end-of-life
assets. A new baseline for cyber resilience The implications for UK organizations are clear. Cybersecurity is no longer just about defending against the unknown. It is about managing the known systematically, continuously and at scale.

This is particularly relevant as cyber risk becomes more tightly linked to regulatory compliance, insurance requirements and board-level governance. The ability to demonstrate control over the attack surface to prove what exists, how it is protected and whether risks have been reduced is fast becoming a baseline expectation.

Attackers are now able to achieve domain-wide control in minutes once inside an environment. In that context, delays in remediation or gaps in visibility are not just operational issues they are critical business risks.

The organizations that will succeed are those that close the gap between insight and action. Those that move beyond assumptions and develop a clear, verifiable understanding of their exposure. Ultimately in todays threat landscape, the greatest risk is not what organizations dont yet know it is what they already know, but havent fixed. We've featured the best firewall software. This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology
industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit



======================================================================
Link to news story: https://www.techradar.com/pro/the-cyber-risk-hiding-in-plain-sight


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)