In Your Biggest Security Risk Isn’t Malware — It’s What You Already Trust, we made a simple argument: the most dangerous activity inside most organizations no longer looks like an attack. It looks like administration. PowerShell, WMIC, netsh, Certutil, MSBuild — the same trusted utilities your IT team uses every day are also the preferred toolkit of modern threat actors. Bitdefender’s analysis of 700,000 high-severity incidents found legitimate-tool abuse in 84% of them.

The reaction we heard most was a fair one: We know. So what do we actually do about it?

That’s what Bitdefender’s complimentary Internal Attack Surface Assessment is built to answer. It’s a 45-day, low-effort engagement available to organizations with 250 or more employees that turns the abstract problem of “living off the land” into a specific, prioritized list of users, endpoints, and tools you can safely take away from attackers without breaking the business.

A clean Windows 11 install ships with 133 unique living-off-the-land binaries spread across 987 instances. Bitdefender Labs telemetry found PowerShell active on 73% of endpoints, much of it invoked silently by third-party applications. This isn’t a malware problem — it’s an over-entitlement problem, and you can’t patch your way out of it.

Gartner now projects that preemptive cybersecurity will account for 50% of IT security spending by 2030, up from less than 5% in 2024, and that 60% of large enterprises will adopt dynamic attack surface reduction (DASR) technologies by 2030, up from less than 10% in 2025. The reason is mechanical: when most intrusions involve no malware and adversaries move in minutes, “detect and respond” is too slow a loop. You have to remove the moves attackers can make in the first place.

The engagement runs in four steps over roughly 45 days, powered by GravityZone PHASR — Bitdefender’s Proactive Hardening and Attack Surface Reduction technology — and sits alongside whatever endpoint stack you already run:

Early-access customers have reduced their attack surface by 30% or more in the first 30 days, with one reporting close to 70% by locking down LOLBins and remote tools — without investigation overhead or end-user disruption.

• For the CISO: a defensible, board-ready exposure number that moves week over week, mapped to behaviors attackers actually use.
• For the SOC and IT admin: up to 50% less investigation and response workload, because entire classes of suspicious-but-legitimate behavior simply don’t occur on endpoints that don’t need them.
• For the business decision-maker: documented, ongoing surface reduction — increasingly what regulators, auditors, and cyber-insurers want to see.

The previous article ended on a principle: the most significant risks are no longer external or unknown — they’re already inside your environment. This one ends on a practice: you can have a precise, prioritized map of those risks within 45 days, at no cost, without changing your existing stack.

If you run a Windows-heavy environment with 250 or more users, request your Internal Attack Surface Assessment here. Compromises will keep happening. Whether one becomes a breach depends almost entirely on what an attacker can reach once they’re in. The fastest way to shorten that list is to look at it.