By Nemanja Krstic, Head of Operations (AME & EU) at Galix
The rapid adoption of cloud platforms, Software-as-a-Service (SaaS) applications, APIs, remote work tools and Artificial Intelligence (AI)-powered systems is changing how organisations operate – and how they need to approach cybersecurity.
In the past three years, the average organisation’s digital attack surface has expanded by more than 67%, according to TechTarget data cited in INE’s 2026 cybersecurity forecast, with enterprises now typically relying on more than 2 000 third-party applications and APIs.
For many organisations, this has created a security environment far beyond the traditional perimeter. What was once a relatively contained, centrally managed IT environment has become a network of interconnected systems, identities, data flows, applications and machine-generated processes.
These technologies deliver clear benefits in productivity, automation and agility, but they are also creating an environment that organisations cannot always fully see or control.
From a defined perimeter to a fragmented environment
Traditionally, security was built around a physical perimeter. Firewalls, network access controls and other technologies protected centrally managed infrastructure, giving organisations a relatively clear understanding of what they were responsible for securing. Cloud and SaaS have fundamentally altered that model.
Organisations now operate across on-premises infrastructure, private and public cloud environments and multiple SaaS platforms. Data can reside across all these environments, each with its own security model and authentication mechanisms.
APIs have intensified the challenge. They have become the standard way to connect systems and automate workflows, yet organisations often struggle to maintain an accurate inventory of the APIs operating across their environment.
One real-world example illustrates the problem. During an assessment for a customer implementing a solution for API security training, the organisation initially believed it had approximately 10 APIs that needed to be included in the scope. Even the internal API team could not provide a definitive figure. As different teams investigated their systems and documentation, more APIs emerged. A few months later, the number had grown from the estimated 10 to well over 150.
The problem was not necessarily deliberate. Systems had changed, integrations had been replaced and different teams had created connections for specific requirements. Some had been disconnected or forgotten, while others remained active. This is where shadow and zombie IT become significant security concerns.
The blind spots created by AI and third parties
As infrastructure evolves, APIs and integrations can be created, replaced or abandoned without their lifecycle being properly documented. Forgotten endpoints and legacy connections can remain active long after their original purpose has disappeared, potentially creating pathways into core systems.AI is introducing another layer of complexity.
An organisation may standardise on an enterprise platform such as Microsoft Copilot, while individual developers use Claude or ChatGPT and other applications rely on embedded AI and machine-learning capabilities.
The result is often multiple AI technologies processing data and interacting with systems, some enterprise-approved and others adopted because they are convenient or free. This creates shadow AI and raises questions about what data is being processed, where it is going and who has visibility over it. The attack surface also extends beyond an organisation’s own technology.
Remote work, contractors, suppliers and technology partners create additional connections into corporate environments. Vendors may use remote-support platforms that provide significant visibility into systems, while third-party applications can retain authentication tokens and integrations after a service is no longer being used.
OAuth-based authentication, for example, makes it easier for users and applications to move between platforms without repeatedly managing separate permissions. But when a SaaS platform is decommissioned, the authentication relationship established with it may not necessarily disappear at the same time.
Third-party suppliers present a similar challenge. A supplier may have legitimate access to an organisation’s environment, but if that supplier or the technology it uses is compromised, the connection can become a pathway into the organisation itself. The third party effectively becomes an extension of the attack surface.
Why continuous visibility matters
The response to this growing complexity can create another problem: alert fatigue. Cloud platforms, endpoints, applications, APIs and third-party systems can all generate security alerts. When these are aggregated, security teams can quickly become overwhelmed by the volume of information, making it harder to distinguish genuine risks from noise. This is why Attack Surface Management (ASM) has moved from being viewed as an additional security capability to becoming fundamental.
Traditional vulnerability assessments and periodic scans provide a snapshot of an environment. That is increasingly inadequate when cloud workloads and microservices can be created, changed and removed rapidly.
Organisations need continuous visibility into what exists, what has changed, what is exposed and how those changes affect their overall risk. This also means looking beyond individual vulnerabilities or severity scores. A vulnerability may be technically serious, but its actual risk depends on where it exists, what it connects to and whether it forms part of a viable attack path.
The speed of attacks makes this even more important. Attackers can use automation and AI to accelerate reconnaissance and identify weaknesses far faster than traditional manual processes. Organisations cannot afford to discover their exposure during a quarterly scan and only then begin remediation. They need continuous discovery, monitoring and risk-based prioritisation.
The role of MSSPs
This is where experienced Managed Security Service Providers (MSSPs) can play an increasingly important role. For many organisations, cybersecurity is critical but not their core business. Building the skills, technology and resources needed to continuously monitor an expanding attack surface can be difficult and expensive.
MSSPs can provide continuous asset discovery across cloud, on-premises, SaaS, APIs, identities and AI-enabled systems, helping organisations identify shadow IT and understand their actual exposure. Their value also extends to remediation. Rather than simply working through an ever-growing list of vulnerabilities, MSSPs can help organisations prioritise weaknesses according to their actual risk and potential role in an attack path.
They can also provide proactive attack simulation, continuously testing whether existing security controls can withstand evolving attack techniques. This provides a more realistic picture of security than treating a single penetration test as proof that an environment is safe.
For smaller organisations, Managed Detection and Response (MDR) can provide another practical option. Not every business can afford a fully staffed, 24/7 Security Operations Centre (SOC), but organisations can combine their existing security technologies with an external team capable of responding to alerts and automating appropriate responses through Security Orchestration, Automation and Response (SOAR).
Innovation needs visibility
The digital attack surface will continue to expand as organisations adopt more automation, AI agents, cloud services, APIs and third-party integrations. The answer is not to slow that innovation, but to understand what every new technology adds to the organisation’s exposure.
Before introducing a new platform, integration or supplier, organisations need to understand what data it accesses, what it connects to and how it will be monitored. They also need processes for retiring those connections when they are no longer required.
Organisations cannot secure what they do not know exists. As technology ecosystems become increasingly interconnected and attacks become more automated, continuous attack surface visibility has become the foundation for understanding where an organisation is exposed, what matters most and where its security efforts should be focused.
Contributed articles reflect the views of their authors, not Africa.com.