Skip to main content
AAAtraq - Accessibility Risk Management

Aug 12 2026

The Cyber Exposure Pools Cannot See

Public-entity risk pools, member leaders, insurers and reinsurers

TL;DR

Public-entity risk pools cannot fully understand shared cyber exposure when member assessments cover only known systems. Forgotten domains, unsupported applications, and unmanaged digital assets remain discoverable, while artificial intelligence makes their weaknesses faster and cheaper to identify.

Risk management article

Central issue

Unknown digital assets

Accelerator

AI-assisted discovery

Pool effect

Aggregated financial exposure

Executive summary

Public-entity risk pools share financial exposure created across many independently managed member organizations. That structure becomes harder to assess when members evaluate only the websites, applications, domains, and services they already know they operate.

The extended digital landscape includes the complete collection of externally visible assets associated with a member, whether currently managed, historically created, supplier hosted, or forgotten. Extended cyber exposure is the risk carried by assets sitting beyond active ownership, maintenance, patching, monitoring, vulnerability management, and retirement controls.

AAAnow's risk profiling across more than 100 million websites between 2017 and 2023 indicates that 41% of assessed digital footprints were unknown to digital teams. The finding is cross-sector rather than a pool-member average. It demonstrates the scale of the gap that can sit between a declared inventory and the complete estate.

The underlying weakness predates generative AI. The acceleration is new. AI increasingly helps attackers discover internet-facing assets, identify technologies, research vulnerabilities, prepare exploitation methods, and connect separate stages of an intrusion. Verizon's 2026 Data Breach Investigations Report found that vulnerability exploitation had become the leading initial breach route, accounting for 31% of breaches.

The chain from unknown asset to shared loss runs in 7 stages. An unknown asset remains outside management. Its technology remains discoverable, and AI reduces reconnaissance effort. Attackers identify a weakness and attempt entry. Successful access enables persistence, credential theft, or disruption. Connected systems can permit wider movement. The resulting operational, financial, legal, and recovery costs can reach the member and, depending on coverage arrangements, the pool.

The first control is therefore landscape knowledge: members need an outside-in inventory reconciled against internal records, with ownership, support status, vulnerability, and retirement decisions attached. Pools need consistent evidence that this work covers externally discoverable assets, not only systems members already remember. Unknown assets should remain classified as live exposure until found, assessed, secured, isolated, or retired. This is the immediate risk-management priority for pools.

Listen: AI turns digital sprawl into active risk

A briefing on what AI reads across an organization's online estate, and the three exposures it creates. Voice intro length: 4 min 47 sec.

Audio briefing - 4 min 47 sec

The exposure begins outside the inventory

A pool cannot measure an exposure its members cannot see. A member may inventory current systems while still carrying a larger public footprint created over many years.

That landscape includes domains, subdomains, websites, portals, cloud services, campaign assets, supplier-hosted systems, and legacy applications. Extended cyber exposure arises when those assets remain accessible but sit beyond active ownership, maintenance, patching, monitoring, vulnerability management, and retirement controls.

An internal inventory records what the organization believes it manages. An outside-in assessment reveals what an attacker can still find.

NIST's Cybersecurity Framework 2.0 makes inventories and lifecycle management foundational. CISA's Binding Operational Directive 23-01 requires federal civilian agencies to discover assets within 7 days and enumerate vulnerabilities within 14 days. The logic applies well beyond federal networks. Discovery comes before protection.

AAAnow's Triad of Exposure reports that 41% of assessed digital footprints were unknown to digital teams, based on P&C and Sitemorse profiling across more than 100 million websites between 2017 and 2023. That is cross-sector evidence rather than a public-entity pool average. Its importance lies in the size of the possible gap between declared estate and discoverable reality.

Temporary publishing became permanent infrastructure

The COVID-era rush online gave public bodies little choice. Services, information, forms, and operational updates moved online quickly. New sites and supplier platforms appeared under exceptional pressure.

The problem arose later, when temporary publishing became permanent infrastructure without an equally deliberate process for ownership, maintenance, and retirement.

A 2026 MS-ISAC report found that 68% of state, local, tribal, and territorial organizations lacked sufficient budget for major cybersecurity priorities. Limited resources concentrate attention on current systems while forgotten assets remain outside controls.

An old asset carries its exposure long after the project ends. Software ages, support ends, staff change, credentials remain, and monitoring stops.

Some risks require no conventional intrusion: Microsoft's dangling DNS guidance explains how deleting a cloud resource while retaining its subdomain can let attackers claim the abandoned resource. They can then deliver phishing, harvest cookies, or host malicious content beneath a trusted organizational address.

This is the orphaned-estate problem in its clearest form. The weakness is straightforward, externally visible, and easy to overlook internally.

Artificial intelligence changes the attacker's economics

Unmanaged websites, weak configurations, and unpatched applications existed long before AI. What AI changes is the time and specialist effort required to search, interpret, and act on them.

The 2026 Verizon Data Breach Investigations Report found that vulnerability exploitation had become the leading initial breach route, accounting for 31% of breaches; Verizon also reported faster AI-assisted exploitation.

Microsoft Threat Intelligence has observed models supporting reconnaissance, vulnerability research, scripting, and exploitation-path analysis. Attackers can move from finding an old site to comparing its software against reported vulnerabilities with less manual work.

This acceleration matters without assuming fully autonomous attacks. Faster enumeration, interpretation, and prioritization allow a human-controlled operation to examine more assets, discard stronger targets, and concentrate effort on systems showing familiar weaknesses.

The next development is orchestration: Anthropic's June 2026 analysis examined 832 banned accounts and found model use across the attack lifecycle, including reconnaissance, credential access, web shells, and lateral movement. Its highest-risk activity involved operational work inside compromised environments.

Anthropic also documented an espionage campaign using an agent to coordinate reconnaissance, exploitation, internal discovery, lateral movement, and data collection under human strategic direction. The risk-management development is the widening scope of what attackers delegate to the model.

7 stages from an unknown asset to shared loss

1. An unknown asset remains outside active management

A website or application can outlive its original project. Legal ownership may remain while operational ownership disappears, leaving the asset outside patching, access review, scanning, and retirement.

It may also be absent from incident-response plans, meaning responders initially lack hosting, supplier, credential, and dependency information when compromise occurs.

2. Unsupported technology remains externally discoverable

Public DNS, certificates, hosting records, and software responses reveal assets and supporting technologies. Outdated systems, exposed administration pages, unsupported firewalls, and dangling cloud services create possible entry points; attackers only need the weakness exposed.

The organizational name and trusted domain can also make a forgotten asset useful for impersonation, credential capture, and malicious distribution.

3. AI reduces discovery and assessment effort

Automation already supports internet reconnaissance: AI adds faster interpretation and prioritization by associating assets, recognizing technology patterns, summarizing vulnerabilities, and identifying targets requiring closer examination.

That advantage becomes more important when defenders are unaware that the target belongs within their own security scope.

4. Attackers identify and attempt initial compromise

Entry can follow a known software vulnerability, stolen credential, exposed administrative interface, insecure configuration, supplier connection, or abandoned cloud resource. CISA's Ghost ransomware advisory describes actors using publicly available code to exploit vulnerabilities in internet-facing servers. The technique is established, and the extended landscape increases the chance that exposed technology sits beyond current defensive attention.

5. Successful access enables persistence or disruption

Initial access is the opening move. Attackers can install web shells or backdoors, create accounts, capture credentials, alter scripts, deploy information-stealing malware, or establish remote access. Some compromises become visible immediately; others remain quiet while attackers learn the environment and preserve their route back.

Quiet persistence extends the loss window and allows attackers to collect the information needed for more consequential activity later.

6. Connected systems can permit wider movement

Whether a compromised public website opens an internal network depends on architecture and controls: shared credentials, connected databases, supplier accounts, administrative access, reused infrastructure, weak segmentation, or unprotected integrations can turn a local compromise into a wider incident.

Suffolk County provides a documented public-entity example: its legislature's 2024 investigation concluded that attackers exploited a Log4j vulnerability in a server within the County Clerk's domain in December 2021. They established persistence, harvested credentials, and later moved into the broader county environment before deploying ransomware in September 2022. Fragmented oversight, end-of-life infrastructure, weak coordination, and missed warnings compounded the original entry.

The months between initial access and ransomware deployment demonstrate why removing the visible vulnerability alone may not remove access already established inside the environment.

7. The resulting loss reaches the member and potentially the pool

Suffolk County estimated more than $25 million in response and remediation costs. Its main website remained unavailable for 5 months, emergency operations were affected, residents lost access to services, and personal information was compromised.

For another member, the consequences could include forensic investigation, restoration, business interruption, emergency legal support, notification, monitoring, fraud, extortion, third-party claims, or litigation. Whether those costs reach a pool depends on coverage, retention, limits, exclusions, and the facts of the claim. The exposure nevertheless begins with a member asset that needed to be known, owned, and controlled.

Why the member problem matters to the pool

Pool structures differ: they can include retained losses, group cyber policies, aggregate limits, tiered retentions, excess insurance, and reinsurance. Great American's public-entity program demonstrates several of these structures.

A single forgotten member website changes little for the membership on its own. The central concern is the same inventory and ownership weakness existing repeatedly across independently managed members.

For a pool, that makes landscape knowledge an aggregation question. Without a consistent baseline, recurring technologies and shared control gaps remain difficult to quantify or prioritize.

Repeated weaknesses matter because pools aggregate exposure: common platforms, suppliers, and delayed patching can create correlated vulnerabilities, recurring claims, retained losses, and additional insurer scrutiny.

The Geneva Association's 2026 report explains how insurers combine protection with baseline requirements, assessment, monitoring, guidance, and response support; limited policyholder visibility makes that role harder.

An unmanaged external estate sits directly inside that visibility problem. A member that cannot evidence its complete external landscape cannot convincingly demonstrate that the associated exposure is identified, owned, maintained, and reduced.

Financial exposure extends beyond the immediate incident

Munich Re's 2026 cyber claims analysis reports that first-party losses represented 62% of actively managed claims, with business interruption, privacy liability, and incident response driving reimbursement. Those categories explain why a seemingly minor external weakness can become a material financial event.

Recovery expenditure can continue long after services return through monitoring, identity protection, legal work, infrastructure replacement, control improvement, and disputed coverage allocation.

Litigation adds another cost layer, although outcomes vary by jurisdiction. The MOVEit vulnerability generated federal multidistrict litigation; conversely, a Columbus cyberattack class action was dismissed under Ohio political-subdivision immunity, showing why public-entity liability cannot be generalized.

Regulatory exposure also depends on member function: in 2025, HHS settled a ransomware-related HIPAA investigation involving a public hospital. Response costs, legal work, statutory duties, claims, and coverage analysis follow the operational damage.

Insurance transfers residual risk rather than replacing exposure control. Prolonged unmanaged exposure weakens evidence of ownership, maintenance, and remediation, potentially affecting underwriting questions and future purchasing discussions.

Landscape knowledge becomes the first control

Members need more than questionnaires listing known websites. Outside-in discovery should begin with organizational identity, domains, registrations, suppliers, infrastructure, and visible connections.

Each discovered asset should then be reconciled against internal records and assigned:

  • A confirmed organizational relationship and accountable owner.
  • A current purpose, business value, and continuing need.
  • A documented supplier, hosting arrangement, contract owner, and support status.
  • A current technology profile and confirmed vulnerability position.
  • A decision to maintain, secure, isolate, replace, or retire.
  • A recorded remediation owner, deadline, and evidence trail.

Retirement must remove exposure rather than hide the page. Redirects can leave vulnerable infrastructure operating, while incomplete cloud decommissioning can enable takeover; closure needs technical verification.

Pools can establish a consistent baseline without controlling member systems. They can define evidence, support assessment, identify recurring patterns, prioritize exposure, and monitor critical remediation.

The baseline should distinguish known, newly discovered, third-party managed, unsupported, and retirement-pending assets so risk treatment remains measurable.

The pool should then aggregate findings without confusing asset counts with risk. A member with 20 well-governed services may present less exposure than a member with one unsupported application connected to sensitive systems. Reporting should therefore distinguish discovery volume, criticality, exploitability, connectivity, data access, remediation age, and control confidence. That approach gives pool leaders a defensible view of concentration, reveals recurring suppliers or technologies, and directs limited assistance toward findings potentially capable of producing material shared loss.

This produces stronger insurer and reinsurer evidence: the pool can demonstrate discovery, ownership, priority treatment, closure, and continuing monitoring beyond self-declared controls.

Monitoring must continue because assets appear, suppliers change, projects close, software loses support, and retired connections can reappear; static inventories begin aging immediately.

The risk-management conclusion

An unknown website is an unmeasured live risk, whatever its age.

AI makes the gap between external discovery and internal awareness increasingly consequential. Pools need confidence that member controls cover the complete discoverable estate, rather than only remembered assets.

A pool understands the cyber exposure it shares only as well as its members can evidence what they still operate online.

Questions and answers

These questions and answers translate the analysis above into member and pool-level action.

1. What should pools include within a member's digital landscape?

The landscape should include internet-facing assets that carry the member's identity, information, services, data connections, or technical dependencies. That extends beyond the principal website to domains, subdomains, microsites, portals, applications, cloud services, supplier-hosted systems, campaign assets, archived services, and relevant DNS records. The test is external discoverability and organizational relationship, rather than whether the asset appears on a current internal list. NIST CSF 2.0 supports inventories covering hardware, software, services, systems, suppliers, and lifecycle status. Operational control of each member asset stays with the member; the pool needs confidence that members identify and govern the exposure comprehensively.

2. Why can a member's existing technology inventory remain incomplete?

Most inventories begin with assets purchased, managed, or recorded through current organizational processes. Older sites may have been created by previous teams, local departments, agencies, suppliers, grant-funded projects, or emergency programs. Ownership records disappear when contracts end and employees leave. Cloud services can also be created and deleted without corresponding DNS cleanup. AAAnow's cross-sector estate analysis found a material difference between assets known internally and those discoverable externally. An incomplete inventory is the predictable result. It shows that internal records alone are an insufficient test of the public attack surface.

3. How does an unknown digital asset create cyber exposure?

An unknown asset can remain outside patching, vulnerability scanning, access review, supplier oversight, logging, and incident-response planning. The control gap creates the risk; the asset's age is secondary. A current system with no owner can be more dangerous than an old system under active management. Unknown DNS records can also point toward deleted cloud resources and permit subdomain takeover. Microsoft's guidance explains how attackers can claim an abandoned resource and control content under a trusted organizational subdomain. Discovery converts an unmeasured exposure into something that can be assigned, assessed, and treated.

4. How do attackers discover forgotten websites and online services?

Internet-facing assets leave public signals through DNS, certificates, hosting records, search indexes, links, archived pages, software responses, and third-party services. Attackers use automated reconnaissance to collect and connect those signals across a large target set. A forgotten site remains discoverable with zero visitor traffic. A public address or technical relationship is enough. CISA's asset-visibility directive recognizes the defensive importance of recurring asset discovery followed by vulnerability enumeration. The practical response is to examine the landscape using the same outside-in perspective before an attacker does.

5. How does artificial intelligence accelerate discovery and exploitation?

AI can associate assets with organizations, recognize technologies, interpret technical responses, summarize vulnerability disclosures, generate scripts, and help prioritize targets. This compresses work that previously required more manual research and specialist time. Microsoft Threat Intelligence has observed threat actors using models for vulnerability and exploit research. Anthropic's 2026 analysis also found AI use across reconnaissance, malware development, credential access, web shells, and later attack stages. AI raises the volume and pace of attempts rather than the success of each one: attackers examine more possibilities and adapt more quickly.

6. How can an old website become an initial attack route?

The site may run unsupported software, an unpatched component, an exposed administration interface, weak credentials, or an insecure integration. Attackers identify the technology and test known weaknesses. Successful exploitation can provide access to the web server or application account. CISA's Ghost ransomware advisory documents actors using public exploit code against internet-facing servers. The key risk-management question is whether the site sits inside current security processes. Age creates the breach only in combination: missing ownership, absent monitoring, and delayed patching turn an old site into a pathway to compromise.

7. What malware or persistence can follow a website compromise?

Attackers may install a web shell, backdoor, malicious script, remote-access tool, credential stealer, ransomware loader, or information-collection utility. They may also create accounts, alter scheduled tasks, or modify application code to preserve access. The chosen mechanism depends on the site, privileges, architecture, and objective. Some attackers disrupt immediately, while others remain hidden and collect information about the environment. The MITRE ATT&CK framework documents these recognized persistence and post-compromise techniques. Member response should therefore include forensic assessment, credential review, connected-system analysis, containment, and verified rebuilding, rather than merely restoring the visible webpage.

8. When can an external compromise reach connected internal systems?

Wider access becomes possible when the compromised asset shares credentials, databases, infrastructure, administrative accounts, supplier connections, cloud permissions, or trusted network routes with other systems. Weak segmentation can increase the consequence: Suffolk County's legislative investigation describes attackers moving from a vulnerable server within the Clerk's domain toward the broader county environment after establishing persistence and harvesting credentials. The progression depends on the environment; pools should ask whether members understand external-to-internal dependencies and whether compromised public systems can be isolated before attackers reach higher-value operations.

9. How can member-level exposure affect pool finances and coverage?

The answer depends on the pool's retained losses, policy structure, aggregate limits, excess insurance, reinsurance, exclusions, and claim circumstances. On its own, a single unmanaged site carries limited weight. Repeated control weaknesses can affect claims experience, risk-control activity, member prioritization, underwriting information, and future purchasing discussions. The Geneva Association describes how insurers use baseline standards, assessments, guidance, monitoring, and response services to influence resilience. Stronger landscape evidence helps a pool demonstrate that exposure is being found and reduced, rather than accepted unknowingly.

10. What evidence should pools now require from their members?

Members should evidence an externally validated asset inventory, the organizational relationship of each asset, assigned operational ownership, technology and supplier details, support status, vulnerability position, and a documented treatment decision. Priority findings should carry responsible owners, completion dates, and closure evidence. Pools should also understand how frequently discovery repeats and how newly identified assets enter existing vulnerability and incident-response processes. The requirement should remain proportionate to member size and exposure, while preserving a consistent minimum standard. The objective is proof that externally discoverable assets are known, governed, and either protected or removed. A longer asset list, by itself, proves none of that.

Comprehensive cyber source catalogue

This catalogue records the complete source set reviewed while preparing this article. It includes material cited in the article and additional supporting material examined during research.

Digital landscape, asset visibility and orphaned infrastructure

Vulnerability exploitation and attacker techniques

Artificial intelligence and operational cyber capability

Public-entity incidents and operational consequences

Financial loss, insurance and pool structures

Litigation and regulatory exposure