Turning things off costs less than fixing them
Every exposure has two exits: fix it or remove it. Fixing needs a maintenance window, regression testing, and somebody who knows the application. Removing needs you to discover it exists and confirm nobody uses it.
In practice, a meaningful share of what is exposed should not be. A staging environment published to the internet, an admin panel with no source restriction, a service from a closed project, a subdomain pointing at a bucket that was deleted long ago. None of that needs a patch. It needs an off switch.
This is the less-discussed half of attack surface work, and it is the half that pays off fastest.
The order that works
First, what is internet-facing and under active exploitation. Remote access services, VPNs, firewalls, edge appliances, and authentication portals, in that order, before any internal high-severity item.
Then, what is exposed for no reason. Here the question is not "what is the CVSS score", it is "does anyone use this". An inventory with an owner per asset answers that in minutes; without an owner, the answer takes weeks and usually nobody switches anything off, out of fear.
Last, what is exposed out of necessity and needs controls: source restriction, strong authentication, segmentation.
Why it stalls
It stalls on attribution. Nobody turns off a service without knowing who depends on it, and most inventories do not carry that information. That is why continuous discovery that attributes each asset to a business unit changes the outcome more than any scanner: it turns "I do not know if I can turn this off" into "I can, and the owner is this team".
How to measure it
Count exposed assets over time, not vulnerabilities fixed. A program that fixes a thousand flaws and keeps the same surface has not reduced risk; it has changed queues. The honest metric is how many entry points existed at the start of the quarter and how many exist at the end.