Attack surface management is the continuous discovery, inventory, classification and monitoring of an organization’s IT infrastructure. Attack surface management is important because it helps to prevent and mitigate risks stemming from: Legacy, IoT, and shadow IT assets. Human mistakes and omissions such as phishing and data leaks. Vulnerable and outdated software.