Improving Attack Surface Detection Accuracy

This case study generalizes a recurring pattern from professional work in a threat intelligence role. Employer, client and other identifying specifics have been abstracted to preserve confidentiality; the outcome figure is accurate.

Problem

An attack surface discovery process fed a platform that identified clients’ internet-facing assets — the foundation everything downstream depended on. It reliably found some of a client’s footprint, but a review against known-good data showed it was systematically under-discovering assets.

Approach

Rather than tune the existing method incrementally, I looked outward — researching how other OSINT tooling in the wider industry approached the same problem, instead of just patching where our own method fell short.

Architecture

Found an external technique we hadn’t adopted yet, and piloted it within the collection work supporting red-team engagements (CBEST, GBEST, TIBER-style assessments) — a natural, lower-risk proving ground before considering it for the wider platform.

Implementation

Once validated there, the technique was folded into the core detection method and integrated into the production pipeline — turning a collection-team experiment into a standing capability across the platform.

Lessons

Innovation doesn’t have to start on the product team. Piloting an external technique on a smaller, contained engagement first is a low-risk way to prove an idea before it earns a permanent place in production.