What is EASM? External attack surface management is the continuous discovery and monitoring of everything your organisation exposes to the internet, seen the way an attacker sees it: from the outside, with no inside knowledge. Its job is to answer a question most companies cannot answer accurately: what do we actually have online right now, and which of it is vulnerable or forgotten?
Why the attack surface keeps growing
Every new marketing site, staging server, cloud account, SaaS tool and acquired company adds to what is reachable from the internet. Much of it is created outside the security team, and much of it outlives the project it was built for. The asset list in a spreadsheet goes stale within weeks, and attackers do not use your spreadsheet. They use the same public sources EASM uses.
What EASM finds
Typical findings from a first EASM run include:
- Forgotten subdomains and staging or test sites still online.
- Dangling DNS records pointing at cloud resources that no longer exist, which can allow a subdomain takeover.
- Admin panels, databases and remote access services exposed to the internet.
- Expired or misconfigured TLS certificates.
- Software versions with known, exploitable vulnerabilities.
- Secrets and internal endpoints leaked in public code repositories or JavaScript files.
- Cloud storage exposed to the public by mistake.
How discovery works
EASM starts from what you know, such as your main domains and company name, and expands outward using public sources: DNS records, certificate transparency logs (which list the certificates issued for your domains), domain registration data, IP address ranges, search engines and public code repositories. Each new asset is then fingerprinted to identify what it runs, and checked for known weaknesses.
Attribution is the hard part. Not everything that mentions your name belongs to you, and not everything you own mentions your name. A good EASM process checks each candidate asset before it is added to your inventory, because acting on an asset that belongs to someone else wastes time, and scanning it without permission is not acceptable.
The important word is continuous. A one-off discovery exercise is useful, but the value comes from noticing change: a new subdomain that appeared yesterday, a port that opened, a certificate that expired. Our Vexta scanner, for example, tracks what changed since the last scan and checks for subdomain takeover.
What a useful EASM finding looks like
A list of IP addresses is not a finding. Each finding should tell you:
- The asset, and the evidence that it belongs to you.
- What is exposed or wrong, with proof, such as the response or certificate that shows it.
- Why it matters: what an attacker could do with it.
- Who owns it in your organisation, or that nobody does.
- The fix, and how you will know it worked on the next scan.
EASM vs vulnerability scanning vs VAPT
The three are complementary, and they answer different questions:
- EASM answers what is exposed. It finds assets you did not know about and watches for change.
- Vulnerability scanning answers what is known to be wrong with the assets you point it at. It cannot scan what it has not been told about.
- VAPT answers what an attacker could actually do. A tester goes deep on chosen targets, including business-logic flaws no scanner finds, but only at a point in time.
EASM and compliance
Several frameworks expect you to know what you have. ISO 27001:2022 control 5.9 requires an inventory of information and other associated assets, and control 8.8 requires you to manage technical vulnerabilities. PCI DSS v4 requirement 12.5.1 requires an up-to-date inventory of system components in scope. EASM does not satisfy these on its own, but its asset list and its history of findings are useful evidence for the external part of them.
What EASM cannot do
EASM sees only what the internet sees. It cannot assess your internal network, your laptops or how your application handles authorisation between users. It finds known weaknesses, not new logic flaws, and its findings still need someone to validate and fix them. That is why EASM sits alongside internal vulnerability scanning and periodic penetration testing rather than replacing them.
Who needs EASM
Any organisation with more internet-facing assets than one person can keep in their head benefits from it. It matters most for companies with many domains or brands, multiple cloud accounts, frequent releases, recent acquisitions, or a duty to report on their exposure to a regulator, insurer or enterprise customer.
How to start
You do not need a large programme to get value. A practical first month looks like this:
- Run a discovery from your main domains and review what comes back.
- Give every asset an owner. Unowned assets are the ones that never get patched.
- Take down what is no longer needed, and fix the critical exposures first.
- Feed the confirmed asset list into your vulnerability scanning and your next VAPT.
- Set up continuous monitoring so new assets are noticed within days, not months.
Frequently asked questions
What does EASM stand for?
Is EASM the same as a penetration test?
How often should EASM run?
Can a small company use EASM?
Find out what you actually have online
We run discovery and continuous monitoring of your external attack surface, and tell you which exposures to fix first.