Most discussions around cybersecurity tend to focus on zero-day vulnerabilities, that is, security holes that are discovered and exploited before software vendors have time to release patches. However, the reality is often much simpler and more worrying. Many successful breaches do not start with sophisticated attack techniques, but with services and systems that should never be exposed to the internet (Attack Surface).
The phenomenon is highlighted in a new analysis by cybersecurity firm Intruder, which examined nearly 3,000 corporate attack surfaces to determine how many web- accessible services pose unnecessary or unjustified risk. The results show that much of an organization’s exposure is not due to unknown vulnerabilities, but rather to misconfigurations, forgotten services, and poor control of digital infrastructure.
Real-time attacks
In recent years, the time between the public disclosure of a vulnerability and the first attempt to exploit it has decreased dramatically. In some cases, cybercriminals need less than 24 hours to launch massive attacks.
See also: Mobile Attack Surface: Businesses Lose Control to Shadow AI
A prime example was the vulnerability MongoBleed, which came to light earlier this year. This vulnerability allowed attackers to extract user credentials and session tokens directly from server memory without requiring prior authentication. In such cases, any service exposed to the internet becomes a potential target.
This is why many experts now argue that the right question is not just how quickly patches are applied, but why a sensitive service was publicly accessible in the first place.
The worrying findings of the research
Intruder's study reveals that the problem is much more widespread than many businesses believe.
According to the research data:
- 60% of organizations had at least one exposed HTTP management panel.
- 49% had publicly accessible dangerous ports or services.
- 42% exposed databases directly to the internet.
- 30% had publicly available records, documentation or sensitive information that was not intended for external access.
These percentages demonstrate that the attack surface of many organizations remains much larger than it should be.
Attack Surface 2026: The most common exposures
The survey recorded the ten most common forms of exposure identified over the last twelve months.
At the top of the list are exposed MySQL databases, which were found in 26% of organizations. PostgreSQL databases at 16%, while publicly accessible API Documentation at 15%.
See also: Mastra npm: 144 packages compromised via supply chain
panels WordPress management ( 15%), remote access services via RDP (11%), phpMyAdmin Admin Panel (8%) as well as protocols – services such as SNMP (9%), UPnP (8%), NTP (7%) and RPC Portmapper (7%) also have a significant presence .
These are technologies that are often installed for internal use, but end up being accessible from the internet due to incorrect settings or inadequate security controls.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Databases remain a favorite target for attackers
It’s no surprise that databases top the list. Data is the most valuable digital asset of any organization, and criminal groups know this well.
Experts recall the PLEASE_READ_ME ransomware, which affected more than 250,000 MySQL databases through brute-force attacks on weak passwords. Similar incidents have also been recorded on MongoDB and Elasticsearch.
When a database is directly exposed to the internet, attackers can perform automated scans and try thousands of credential combinations in no time.
The Underrated Threat of APIs
One of the most interesting findings of the research concerns API documentation. While many consider remote access via RDP to be the most significant risk, public API documentation exposure is even more common.
APIs are now the core of modern applications and services. But when their documentation is available without restrictions, it can provide an attacker with a complete “roadmap” of available functionality, making it significantly easier to find vulnerabilities.
See also: ClickFix campaigns expand malware distribution with new loaders and fake updates
Reducing the attack surface becomes a priority
The key finding of the research is that cybersecurity is not limited to vulnerability management and patching. Reducing the attack surface is becoming an equally critical protection factor.
Removing unnecessary services, limiting public access to management systems, properly segmenting networks , and constantly monitoring exposed resources can drastically reduce the risk of a breach. In an era where attacks are automated and executed within hours, the best defense is often not a new patch, but eliminating an entry point that should never have been available online.
