EASM: Your Attack Surface Through an Attacker's Eyes

EASM refers to the ongoing identification, inventorying and assessment of all of an organization's internet-facing assets – from the outside perspective and without prior knowledge of the internal inventory. The focus is on the “unknown unknowns”: forgotten subdomains, legacy systems, test and staging environments, cloud resources procured independently by business units (shadow IT), and exposed services such as remote access points, admin interfaces or databases. OWASP describes the attack surface as the sum of all paths through which data and commands enter and leave a system – EASM applies this view systematically to an organization's entire publicly reachable IT.

Starting from a handful of starting points (“seeds” such as primary domains, IP ranges or company names), EASM techniques correlate publicly available data sources: active and passive DNS, Certificate Transparency logs (public, append-only registers of issued TLS certificates per RFC 9162), WHOIS/RDAP data, ASN and IP allocations from the internet registries, and internet-wide scan data on open ports and services. Leak sources such as credential dumps and paste sites are added to detect exposed credentials belonging to the organization's own domains. Because the very same sources are open to attackers as well, the result shows exactly the picture an attacker sees during reconnaissance.

Not every finding is a relevant risk. Raw discovery data must first be attributed: does the asset actually belong to your own organization, to a service provider or to a CDN? Findings are then validated – is the service really reachable, is the configuration actually weak, is the vulnerability practically exploitable? – and prioritized by exposure, exploitability and business criticality. Without these steps, EASM produces long lists instead of actionable results; with them, remediation focuses on the findings an attacker would realistically use first.

A vulnerability scanner checks known systems against known vulnerabilities – it presupposes a well-maintained inventory and remains blind to assets nobody has registered. A penetration test examines a predefined scope manually and in depth, but delivers a snapshot in time. EASM comes in before both: it first answers the inventory question (“What is actually visible from the outside?”) and thereby delivers the scope that scanning and pentesting require. The three approaches do not replace one another – they interlock: EASM finds the surface, the scan tests it in breadth, the pentest in depth.

External attack surfaces change constantly: new cloud deployments, automatically issued certificates, configuration changes, acquisitions and expiring contracts shift the picture, sometimes daily. An annual scan or pentest cannot capture this change. How short the intervals have become is illustrated by the US cybersecurity agency CISA: its directive BOD 23-01 (2022) requires US federal agencies to perform automated asset discovery at least every seven days and vulnerability enumeration of all discovered assets every 14 days. The NIST Cybersecurity Framework 2.0 likewise anchors maintained inventories of hardware, software and services (category ID.AM) as a foundation of risk management.

In practice, EASM follows a recurring cycle: starting from seeds, discovery identifies assets, consolidates them into an inventory and assigns each one to an owner. Assessed and validated findings enter the existing processes (vulnerability management, ITSM) as prioritized, traceably documented tickets – including concrete remediation recommendations such as decommissioning, patching, hardening or moving behind VPN or Zero Trust access. After remediation, a renewed check from the outside confirms that the exposure has actually been eliminated. Metrics such as time to remediation and the number of newly discovered unknown assets make maturity measurable over time.