Asset-Centric Security Loses Today’s AI Gunfight
By Sumedh Barde, Chief Product Officer, Simbian
For years, enterprise security has been shaped by two opposing worldviews.
On the one hand you have the Absolutists. This side swears there are countless types of attackers with infinite possible exploits, and the only sane response is to lock everything down. And then there are the Pragmatists. They believe most assets aren’t meaningfully reachable from the outside, and that the only exposures to worry about are the ones an attacker can touch.
This divide isn’t surprising. It just demonstrates how teams prioritize work, how they justify spending, and how they measure risk.
The Trap of Compliance Comfort
Regulations and compliance audits often lead security teams down the safest, least controversial road, the asset-centric model – the title of this article. Compliance focuses on checkboxes, not attack paths or adversary intent. It requires organizations to count their servers, document their configurations, and run a pen test, which might produce the same predictable results as last year.
And because auditors can check all these boxes, they can easily get budget. At the same time, offensive capabilities like red teaming, breach and attack simulation (BAS), and attack surface management (ASM) rarely get the same attention, even though they’re the tools that measure exposure from an attacker’s point of view.
It’s problematic that the tools that actually view the world the way attackers do are the ones that are considered optional or conveniently underfunded.
Cyber Offense has a New Reality
Meanwhile, the AI era is rewriting the tempo needed for a cybersecurity offense. Consider that it enables reconnaissance at machine speed, payload crafting without any skill, industrial-scale credential theft, and phishing schemes that look more like SaaS products than crimeware.
This all means that the only way to stay afloat is to adopt a new perspective on the matter – seeing yourself exactly the way an attacker does. This new perspective is built on four pillars.
1. Penetration Testing: Deep Cuts but Narrow Lanes – Penetration testing is the most formalized approach in offensive security because it maps neatly to compliance requirements. It analyzes a single asset or tightly scoped set of assets – for example an external API, application, or endpoint – and gives organizations benefits such as hard evidence of exploitable flaws; real attack paths; and proof of logic errors, outdated protocols, or security blind spots.
However, penetration testing needs play within the rules so as not to disrupt the applications it is testing. Attackers don’t respect boundaries, but pen tests must.
2. Red Teaming: No Rules, No Nets, No Illusions – Red teaming is offensive cybersecurity with no holds barred – no asset bounds, no artificial guardrails, no technique restrictions. Their directive reflects that of real adversaries – if a path exists, it’s fair game. This includes social engineering and phishing; token theft, identity pivoting, and credential misuse; SaaS misconfiguration and cloud abuse; multi-step lateral movement; chained privilege escalation; human-enabled or physical intrusion; and everything MITRE documented and everything it didn’t.
Red teaming adds all layers (technical, procedural, human) in approaches that mirror genuine attacker tradecraft. While pen testing is like asking a single, pointed question (Can this specific asset be exploited?), red teaming asks more uncomfortable questions. For example: Is there any sequence or any combination of moves – no matter how indirect – that could help an attacker to their end goal?
3. Attack Surface Management: External Discovery at Full Breadth – Attack Surface Management (ASM) operates between pen testing and the full offensive complexity of red teaming. Its purpose is to show everything an attacker can discover from the outside – often far more than what security teams believe is actually exposed.
For example, ASM sheds light on internet-facing assets you forgot existed; abandoned hosts, rogue APIs, and dead services; open ports, dangling identities, and exposed endpoints; the complete external footprint; and an attacker’s first 30 seconds of recognisance.
ASM’s job is to highlight the full breadth of entry points a real-world adversary might probe, automate against, or exploit as their starting point. It does not perform deep exploitation like pen testing, nor does it stage multi-step attack paths like red teaming.
4. Validating Controls Against Known Attack Sequences with Breach & Attack Simulation (BAS) – BAS is an approach that focuses exclusively on replaying known attacker techniques, rather than discovering exposures or proving new vulnerabilities. It answers the question: If a specific threat actor or malware family targeted us today, how would our environment respond?
Using real-world TTPs, BAS systems reproduce entire attack chains so organizations can validate whether detection, alerting, and response mechanisms work as intended. BAS serves as diagnostic rather than exploratory, checking whether existing controls address the scenarios they are supposed to handle.
DAST & Fuzzing: Adjacent, Useful, but Not the Main Plot
It’s worth noting that Dynamic Application Security Testing (DAST) and fuzz testing (fuzzing) are also important offensive techniques, similar to pen testing but not replacing it. They’re just not designed to model attackers.
They are often in the same conversations, but DAST can be used entirely internally, even on code that has no external exposure. It can also uncover performance defects, dead code, or behavioral anomalies unrelated to security. And fuzzing generates malformed or randomized input sequences to stress applications.
Faster Reconnaissance, Lower Barriers, and Continuous Exposure
Against modern and sophisticated AI threats, today’s defense isn’t failing. It’s just operating at the wrong frame rate. AI collapses the entire attack chain into seconds, and nothing built on human speed – including checklists, processes, and expertise – can keep up.
So, the only strategy to have a chance at success is simple, brutal, and necessary – continuous, automated, adversarial pressure, not to break things, but to predict exactly where they will break next. One not only needs a mix of all of the above techniques for full coverage, but must run all of the above at machine speed. Most defenders are still fighting like the world moves at human speed. It doesn’t. Not anymore.