How You’ll Be Doing Attack Surface Management Differently in 2026

Greg Young, VP Cybersecurity and Corp Dev at Trend Micro and former Gartner analyst, traces attack surface management from procurement lists through EASM and CAASM to the emerging category of cyber risk exposure management (CREM), which links asset, identity, threat and data context in one platform instead of siloed tools. He walks a real multi-step breach (initial CVE exploitation, name-resolution spoofing, password-hash cracking, lateral movement into an unprotected dev environment, credential theft, domain admin via a misconfigured AD certificate template, then ransomware) and shows where each step could have been stopped with zero-trust access, Credential Guard, EDR, and stronger password policy. He argues legacy tools give industry-average, undefendable importance scores, and that the next generation should use attack-path prediction and full telemetry to defend prioritization decisions to a board, tie remediation to compliance impact, and express risk in dollar terms using cyber risk quantification (the FAIR methodology) rather than raw CVSS scores. A Q&A covers compliance sometimes breaking when security controls change, and how AI is speeding up both attackers and defenders, especially in vulnerability triage and remediation.