What is external attack surface management?
External attack surface management (EASM) is the continuous discovery, cataloguing and monitoring of every asset an organisation exposes to the public internet. It works from the outside in, mapping domains, subdomains, IP ranges, cloud storage, APIs and mail infrastructure the way an attacker would, rather than trusting an internal asset register to be complete.
The word 'external' sets the scope: anything reachable from the public internet without needing internal network access, including forgotten test or staging environments. Assets behind the perimeter are the domain of internal testing and of asset inventory tooling, not of EASM.
The question EASM exists to answer sounds simple and rarely is: what does this organisation actually expose to the internet, right now, today, not what an architecture diagram from eighteen months ago says it should expose.
The shadow IT problem EASM exists to solve
Most organisations do not lose track of assets through carelessness. It happens as a side effect of normal operations. A business unit trials a SaaS tool and leaves a public dashboard live after the trial ends. A marketing team stands up a campaign landing page on a subdomain nobody documents. A developer spins up a staging server for a migration and forgets to tear it down. An acquisition brings in infrastructure that was never added to the parent company's asset register. A storage bucket gets set to public for a one-off data export and is never reverted.
None of these are dramatic security failures on their own. Collectively, they are how an attack surface grows faster than the asset register meant to track it, and why 'we don't have that asset' is one of the more dangerous sentences in security.
- Dangling DNS records. A subdomain still pointing at a decommissioned service, for example a record reading promo.example.com. 300 IN CNAME app.retired-host.net. where the target no longer resolves to anything you control, can leave the door open to subdomain takeover. MITRE ATT&CK tracks the attacker side of this as compromise infrastructure: domains (T1584.001).
- Expiring or misconfigured certificates. Easy to miss when nobody owns the renewal, and a common trust signal attackers and customers both notice.
- Forgotten staging or development instances. Often running weaker authentication than production because they were never meant to stay internet-facing.
- Exposed cloud storage or admin panels. Left public during testing, or misconfigured during a permissions change that was never fully wound back.
- Unowned mail infrastructure. A sending domain with a permissive policy, such as a _dmarc.example.com TXT record still set to v=DMARC1; p=none, is part of the external surface even though it serves no web content.
- Shadow SaaS and unmanaged accounts. Tools adopted outside procurement, with no one responsible for their security configuration.
EASM, CAASM and CTEM: how the three fit together
Three acronyms turn up constantly in the same conversation and are routinely used as if they were interchangeable. They are not. They describe different scopes, and one of them is a programme rather than a tool category.
Cyber asset attack surface management (CAASM)
CAASM is the practice of building a single, queryable inventory of all assets, internal and external, by aggregating what existing systems already know. It integrates with cloud provider APIs, endpoint management, directory services, configuration management databases and vulnerability tooling, then reconciles the overlaps into one view.
Its strength is coverage and context: it can tell you which assets are missing an endpoint agent, or which cloud instances have no owner recorded. Its limitation is definitional. CAASM can only see assets that some connected system already records, so an asset nobody ever registered anywhere stays invisible to it.
Continuous threat exposure management (CTEM)
CTEM is not a product category at all. It is a programme model for running exposure reduction as a repeating cycle rather than a series of disconnected projects. It is usually described as five stages: scoping, discovery, prioritisation, validation and mobilisation.
The two stages organisations most often skip are validation, which asks whether an exposure is genuinely exploitable rather than merely present, and mobilisation, which turns findings into assigned, tracked remediation work. A programme that stops after discovery and prioritisation produces reports rather than reduced exposure.
How they relate in practice
The cleanest way to hold the three apart is by what each contributes to a CTEM cycle. EASM supplies outside-in discovery of the internet-facing surface, including assets no internal system records. CAASM supplies inside-out aggregation and ownership context for assets that are already known. CTEM is the operating model that consumes both, then adds the validation and mobilisation stages neither tool category performs on its own.
Run alone, EASM produces a list of exposures with no owners and no proof of impact. Run alone, CAASM produces a tidy inventory with a blind spot exactly where shadow IT lives. Run as the discovery stage of a CTEM cycle, they complement each other and feed a validation step that decides what actually deserves attention.
How EASM discovers assets
EASM tools combine a small set of discovery techniques, most of them the same reconnaissance techniques used at the start of a penetration test, run repeatedly instead of once. The same activity is catalogued under the Reconnaissance tactic in MITRE ATT&CK, which is a useful reference for understanding what an attacker can learn before touching anything: active scanning (T1595), searching open technical databases (T1596), and gathering victim network information (T1590).
Passive discovery
Passive techniques gather information without directly touching the target: WHOIS records, DNS records including historical DNS, certificate transparency logs, search engine indexing, and public breach or exposure data. Certificate transparency is particularly productive, because every subject alternative name on a publicly issued certificate is a hostname somebody asked a certificate authority to vouch for, whether or not it was ever added to an inventory.
Passive discovery is low-risk and often surfaces assets that active scanning alone would miss. A quick manual sanity check on a single record, for example dig +short CNAME promo.example.com, is the same class of lookup, done one hostname at a time instead of continuously.
Active discovery
Active techniques probe the internet-facing surface directly: port and service discovery, banner grabbing, subdomain enumeration, and HTTP fingerprinting. This confirms what passive discovery suggests and finds what it missed, such as a service running on an unexpected port.
The web-facing portion of this maps closely to the information gathering phase of the OWASP Web Security Testing Guide, which is a reasonable checklist against which to judge how thorough a given tool's active discovery actually is.
Continuous re-checking
The defining feature of EASM, versus a one-off asset audit, is repetition. Assets are re-verified on a schedule rather than documented once, so the exposure map for this week actually reflects this week, not the audit from last quarter.
EASM vs vulnerability scanning vs penetration testing
The three are related and often confused, but they answer different questions and start from different places.
| Dimension | EASM | Vulnerability scanning | Penetration testing |
|---|---|---|---|
| Primary question | What do we expose, and has it changed? | Do known assets have flagged issues? | Can an attacker get in, and how far? |
| Starting point | Discovery-led; finds assets you did not list | The asset list you provide | A scope you define in advance |
| Depth vs breadth | Breadth over depth | Moderate depth on known assets | Depth-first, includes exploitation |
| Typical cadence | Continuous | Scheduled, e.g. monthly | Periodic engagement, or continuous |
| Validates exploitability | Rarely, on its own | No, it flags only | Yes, that is the point |
| Best for | Catching unknown or forgotten assets | Tracking known CVEs on known assets | Proving real-world impact |
Why agentless discovery matters here
EASM is almost always delivered agentlessly: nothing is installed on the assets being watched. Observation happens entirely from an external vantage point, roughly the same view an attacker doing reconnaissance would have.
This is not just a deployment convenience. It is close to a logical requirement. If you knew about an asset well enough to install monitoring software on it, you probably would not have lost track of it in the first place. Agentless discovery is what makes it possible to find the subdomain, bucket or staging server that never made it onto any asset list, because it works from what the internet can see rather than from what an inventory already claims exists. Agent-based monitoring still has a place, but it belongs on internal assets you already control, not on external discovery of the unknown.
Where EASM sits in a standards-based programme
EASM is a newer label for an old control. Every major control framework opens with knowing what you have, which is worth pointing out when justifying the spend to a board or an auditor: this is not an emerging nice to have, it is the first item on most baselines.
- CIS Critical Security Controls. Control 1 is inventory and control of enterprise assets and Control 2 is inventory and control of software assets, both ahead of any detection or response control. See the CIS Controls.
- NIST Cybersecurity Framework. Asset management sits in the Identify function, and the framework treats it as a precondition for the Protect and Detect functions rather than a parallel activity. See the NIST Cybersecurity Framework.
- Australian guidance. The Australian Signals Directorate's Australian Cyber Security Centre publishes hardening and patching guidance that all assumes a known asset list; an undiscovered internet-facing host is by definition outside every one of those controls. See cyber.gov.au.
- Exploitation-aware prioritisation. Once assets are known, the CISA Known Exploited Vulnerabilities catalog is a practical filter for deciding which newly discovered exposures need attention this week rather than this quarter.
What to look for when evaluating an EASM capability
Not every product marketed as EASM does the same thing underneath. A few questions separate genuine continuous discovery from a scan that just repeats a fixed list on a timer.
- Discovery breadth. Does it find subdomains, IP ranges, certificates, DNS records and cloud-facing assets on its own, or only check a list you feed it?
- Re-verification cadence. How often is the inventory itself re-checked, not just how often alerts happen to fire?
- Validation, not just flags. Does it help you work out whether a change actually matters, or only report that something changed?
- Change history. Can you see what changed, when, and compare it against a known-good baseline, rather than just the current snapshot?
- Alert signal quality. Does it prioritise, or does it produce a firehose you learn to ignore?
- Connection to deeper testing. Does discovery feed into validation and remediation, the last two stages of a CTEM cycle, or stop at a list of things you now have to investigate yourself?
What EASM does not do
EASM is discovery and monitoring, not proof. Finding a newly exposed service, or a certificate about to lapse, tells you something changed. It usually does not tell you whether an attacker could actually exploit it, or how far they could get from there. Confirming that requires deeper testing or exploitation validation, covered in attack path validation.
EASM is also external by definition. It has no visibility inside your network, so it complements internal testing rather than replacing it. And its coverage is only as good as the discovery techniques underneath: a tool that only checks a domain list you supply is not meaningfully different from a manual asset register, however it is marketed.
How PentestOps helps
PentestOps runs continuous, agentless external attack surface management as part of its Continuous Security capabilities: the perimeter is re-checked between scheduled scans, changes raise real-time threat alerts, and every observation ships with an HMAC-signed record for a tamper-evident audit trail.
It is backed by an asset inventory with AI classification and criticality, 7-day re-verification, and full drift detection, so new, missing or changed assets show up in a change ledger rather than staying invisible until the next scheduled engagement. What EASM finds is not left as an unvalidated alert either: it feeds into exposure management, where safe, RoE-gated exploitation confirms what actually matters. In CTEM terms, that covers the validation stage that discovery-only tooling leaves to the customer.
Read the full detail on continuous monitoring (EASM), or run a free demo scan to see the discovery approach in action. All paid plans start with a 7-day free trial. A card is required to start your trial and is only charged after the trial ends, unless you cancel first.