For IT administrators, the useful response is not simply another dashboard. It is a maintained record of assets, owners and permissions, paired with a process for investigating changes and retiring access. Microsoft’s documentation offers two concrete starting points: external infrastructure discovery and enterprise application permission reviews. They address different parts of the problem, not interchangeable ones.
What the growth figures actually establish
INE’s 2026 cybersecurity forecast attributes attack-surface growth of more than 67% since 2022 to TechTarget and states that the average enterprise depends on over 2,000 third-party applications and APIs. These are attributed forecast claims, not a measurement of every organization or proof that any particular business has that many integrations. The inspected forecast does not explain the underlying methodology alongside those figures.
The distinction matters: “since 2022” should not become a rolling “past three years” claim whenever the statistic is repeated. Administrators need their own baseline rather than a borrowed average.
Krstić’s more tangible example concerns an unnamed customer whose estimated API inventory rose from about 10 to well over 150 during investigation. It is an anecdote, not a representative study, but illustrates the consequences of fragmented ownership. He also identifies unapproved AI tools, remote-support connections and supplier access as areas needing scrutiny.
External discovery is useful—but bounded
Microsoft documents Defender External Attack Surface Management, or Defender EASM, as a way to discover internet-exposed infrastructure related to known organizational assets. Its inventory can include web applications, third-party dependencies and web infrastructure.
The important word is external. Microsoft explicitly says private IP addresses cannot be used as discovery seeds. This is not a complete inventory of internal systems, SaaS permissions or employee AI use. The practical implication is to combine external findings with other operational records rather than declare the inventory finished.
Microsoft’s discovery documentation also puts a useful boundary around “continuous”: discovery groups have a recurrence setting, with Weekly as the recommended default. Selecting Never produces a one-time discovery run. Continuous management therefore should not be read as instantaneous detection of every change.
For administrators evaluating any discovery service, the question should be: What does it discover, how often, and what remains outside its view? A reassuring asset count is less useful than a clear answer.
A practical Entra check for lingering app access
The access side deserves separate attention. Microsoft provides a documented review process for applications added to an Entra tenant through user or administrator consent. With an active Entra subscription and an appropriate administrator role, teams can inspect permissions without first deploying an external discovery product.
To review a candidate application:
- Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
- Open Entra ID > Enterprise apps > All applications.
- Select the application, then Permissions.
- Examine both Admin consent and User consent.
- Select individual permissions to inspect their details.
For an approved removal, an administrator can use the permission’s … control under Admin consent, then select Revoke permission. Microsoft documents an important limitation: permissions shown under User consent cannot be revoked from that portal tab; administrator removal requires Microsoft Graph or PowerShell.
Treat this as a controlled access review, not a bulk-delete exercise. Microsoft Support warns that removing permissions can break application functionality. Microsoft Learn also notes that revocation does not, by itself, prevent users from consenting again. Successful cleanup should therefore include checking the resulting permission state, validating legitimate workflows and considering whether consent policy needs attention.
The takeaway: finding an application and reviewing its authorization are separate jobs. An external infrastructure inventory cannot replace the latter.
Make ownership and retirement part of the process
As an operational recommendation, build a short lifecycle record for each important platform, API or supplier connection:
- Owner: Who can explain its purpose and approve changes?
- Data: What information may it read, transmit or modify?
- Access: Which accounts, permissions and integrations support it?
- Monitoring: Who investigates unexpected activity?
- Retirement: Who confirms that unnecessary access has actually been removed?
For AI-enabled tools, add a specific question: Which data and connected systems can this capability reach? That keeps the discussion focused on exposure rather than whether a product happens to carry an AI label.
Prioritization should similarly produce decisions, not just longer queues. Ask whether an exposure is reachable, what business data lies behind it and who can remediate it. The proposed measure of success is validated, reduced exposure—not the number of alerts collected.
Outsourcing does not remove the need for scope
Krstić recommends managed security service providers for discovery and prioritization, and managed detection and response for organizations lacking round-the-clock security staffing. His role at Galix is relevant context: this is a security-services executive’s recommendation, not a comparative finding that outsourcing is universally necessary.
Before buying such a service, ask prospective providers to define their coverage, discovery cadence, response authority, exclusions and remediation responsibilities. Require those answers in the service scope rather than assuming that “managed” means every asset and connection is covered.
The broader lesson is straightforward: make visibility an ongoing responsibility, give each connection an owner, and require an explicit exit process. Innovation needs room to move—but yesterday’s integration should not retain tomorrow’s access simply because nobody remembered to close the door.