Attack Surface Management (ASM) tools promise reduced risk. What they usually deliver is more information. 
Security teams deploy ASM, asset inventories grow, alerts start flowing, and dashboards fill up. There is visible activity and measurable output. But when leadership asks a simple question, “Is this reducing incidents?” the answer is often unclear. 
This gap between effort and