Adaptation of attack surface reduction clusters

A method for adaptation of attack surface reduction (ASR) clusters of endpoints in an organization, comprising:

• tracking events that occur in the environment including exclusion history events and user requested events;
• implementing an initial clustering of endpoints in which each endpoint is placed into a single ASR cluster;
• determining affinity of endpoints and ASR clusters;
• joining the single ASR clusters into a group of ASR clusters based on endpoint and cluster affinity;
• placing the grouped ASR clusters into a vertical hierarchy comprising layers, in which a bottom of the hierarchy comprises clusters each having a single endpoint, and a top of the hierarchy comprises a single ASR cluster having all the endpoints, in which the hierarchy identifies multiple sets of potential ASR clusters for adaptation;
• selecting ASR clusters from one of the layers in the hierarchy to form a working ASR cluster set;
• and
• dynamically adapting the ASR clusters in the working set according to exclusion history events and user requested events.

One or more hardware-based non-transitory computer readable memory devices storing computer-executable instructions which, upon execution by one or more processors in a computing device, cause the computing device to:

• apply attack surface reduction (ASR) rules to manage membership of one or more endpoints in a group of ASR clusters;
• monitor changes in endpoint characteristics based on exclusion events for service and file usage occurring in the endpoints and user requests for exclusions or exceptions to service and file usage at the endpoints;
• and
• in response to the monitored changes, adapt the ASR clusters by one of moving an endpoint between existing ASR clusters, merging existing ASR clusters, or placing an endpoint into a newly created ASR cluster.