Organisations with experience in external attack surface management can help us shape future ACD 2.0 services.