Help the NCSC understand how organisations approach external attack surface risk
Earlier this year, we invited organisations with experience of external attack surface management (EASM) and exposure management solutions to take part in our ACD 2.0 research.
Through those conversations, we’ve gained valuable insights into how organisations use EASM solutions in practice, including how they review findings, prioritise activity, and respond to potential risks.
We’re now interested in understanding the earlier stage of that process. We want to learn about the considerations, challenges, and decisions organisations face as they:
- assess external attack surface risks
- evaluate potential approaches
- determine what support, tools or services best meet their needs
Whether you’re considering EASM for the first time, evaluating and comparing different approaches, or have recently selected, purchased, or implemented a solution, we’re interested in learning from your experiences.
You might be someone who:
- evaluates cyber security tools, services or technologies
- contributes to cyber risk management activities
- influences or makes cyber security investment decisions
- manages procurement, purchasing or supplier selection activities
- provides cyber security governance, assurance, or strategic leadership
- has recently been involved in decisions relating to external attack surface management, exposure management, or related security capabilities
We’re particularly keen to hear from people involved in identifying organisational needs, evaluating options, building business cases, influencing investment or procurement decisions, selecting suppliers, or shaping their organisation’s approach to external attack surface risk.
Source: UK NCSC (Cyber) (2026-10-12)
