This article examines the gap between effort and outcome in Attack Surface Management (ASM). It highlights how security teams often focus on asset counts rather than meaningful risk reduction metrics, leading to unclear ROI. It proposes a shift towards measuring response quality and exposure duration to better assess ASM effectiveness.