Organizations that want to manage their security risk need to understand how they are exposed. The applications an organization runs make up a tremendous amount of this exposure due to the fact that vulnerabilities in the applications, as well as misconfigurations, are likely targets for attackers.
Being able to properly defend these applications requires the organization to first identify their attack surfaces before meaningful risk management can take place.
