What is attack surface management?
Attack surface management is the practice of finding every internet-facing asset your organisation owns, such as domains, servers, open ports and certificates, and tracking how that set changes.
What does attack surface management do? Six core functions.
Your attack surface is everything an attacker can reach from outside. It grows quietly: a test site, a new subdomain, a database port opened for a quick fix. Attack surface management (ASM) keeps an up-to-date picture of it.
Discover assets
Find domains, subdomains, IP addresses and network ranges that belong to you, including ones nobody recorded.
Map and classify
Record what runs on each one: open ports, the services behind them and the certificates they present.
Assess exposure
Check those services for known flaws, weak configuration and certificates close to expiry.
Prioritise
Decide which findings matter first, using how likely an attacker is to use them and how exposed they are.
Monitor change
Compare what you see now with what you saw before, so new hosts and newly opened ports stand out.
Report and hand off
Give the people who fix things a clear list, grouped by the host each finding belongs to.
ASM, EASM and internal ASM: what is the difference?
The three terms describe the same job from different positions. The difference is where you stand when you look.
What does EASM stand for?
EASM stands for external attack surface management. It looks at your organisation the way an outsider does, starting from a domain name or a company name and working outwards. It needs nothing installed on your network.
What is the difference between EASM and ASM?
ASM is the wider term. It covers every asset an attacker could reach, wherever they start. EASM is the external part of it. In practice, many vendors use the two words as if they meant the same thing, so check what a product actually looks at.
What does IASM mean?
IASM stands for internal attack surface management. It maps devices, accounts and services inside your network, usually with agents, network sensors or direct connections to your systems. It answers a different question: what could an attacker reach once they are already in?
Small-team platform, enterprise platform or open source? Pick by who will run it.
Most buying mistakes come from choosing a tool built for a bigger team than yours. This table compares the three approaches in general terms, not named products.
| Small-team platform | Enterprise platform | Open-source tools | |
|---|---|---|---|
| Typical buyer | One to ten people looking after IT and security. | A dedicated security team with several specialists. | Engineers who are comfortable running and maintaining their own tooling. |
| Setup | Add a domain and verify it. Nothing to install. | Onboarding project, often with connections to cloud accounts and internal systems. | Install, script and schedule each tool yourself. |
| Strength | Plain results that a generalist can act on. | Scale, automation and wide asset coverage. | Flexible, transparent and no licence fee. |
| Trade-off | Fewer integrations and less automation than an enterprise platform. | More to configure, and priced and designed for larger organisations. | You join the output together, keep it up to date and decide what it means. |
| Examples of tools | Platforms aimed at small teams, such as EdgeProtect. | Large-vendor platforms. | Tools such as Amass, Subfinder, Nmap, httpx and Nuclei. |
Open-source tools are a good way to learn what discovery looks like, and some teams run them for years. If you want to go that way, read our guides to open-source attack surface management and open-source vulnerability management tools.
EASM, CTEM and vulnerability management: how do they fit together?
They answer different questions, and most security programmes end up with all three.
| EASM | CTEM | Vulnerability management | |
|---|---|---|---|
| Main question | What do we have that anyone online can reach? | Which exposures could an attacker really use, and are they being fixed? | Which of our systems have a known software flaw? |
| Scope | Internet-facing assets: domains, hosts, ports, certificates. | Everything an attacker could use, across a five-stage programme. | Software you run, matched against known flaws. |
| Testing | Maps and reports. Does not attack anything. | Includes a validation stage that tests attack paths. | Matches versions to known flaws. Rarely proves them. |
| Learn more | This guide | CTEM explained | Vulnerability management |
What do real exposure incidents look like? Four public examples.
Each of these started with something reachable from the internet that the owner either did not know about or had not fixed.
Equifax, 2017
Attackers used a known, unpatched flaw in the Apache Struts framework on an internet-facing consumer dispute web application. About 147 million people were affected.
Capital One, 2019
A misconfigured web application firewall let an attacker obtain credentials and read data held in cloud storage. About 100 million people in the United States were affected.
Colonial Pipeline, 2021
Attackers got in through a legacy VPN account that did not use multi-factor authentication, according to evidence given to the US Congress.
Citrix NetScaler gateways, 2023
Criminals exploited a flaw tracked as CVE-2023-4966, known as Citrix Bleed, in internet-facing gateways to hijack sessions. Many organisations did not know which gateways they exposed.
Is EdgeProtect right for your team? An honest answer.
EdgeProtect is built for small IT and security teams that want to see what their business has open to the internet, without installing anything.
What it does. Give it a domain you have verified and a scan maps the subdomains, hosts, open ports, services and certificates anyone online can reach, with known flaws on those services. Run a second scan later and compare the two to see what appeared and what has gone.
What to know before you rely on it.
- Discovery is scan-based. Scans do not repeat by themselves, so run one whenever something changes, such as a new website or a move to a new host.
- It is external only. It does not map devices or accounts inside your network.
- It maps and reports exposure. It is not a penetration test and never attacks anything.
If you need discovery that runs on its own across thousands of assets, or internal asset mapping, look at the enterprise column in the table above. To see how scans fit into a wider programme, read about continuous threat exposure management. The full list of what a scan records is on the attack surface management feature page.
Attack surface management (ASM) is the practice of finding every internet-facing asset an organisation owns, such as domains, servers, open ports and certificates, and tracking how that set changes over time.
ASM is the wider term for finding every asset an attacker could reach. EASM, or external attack surface management, is the part that views the organisation from the outside. Vendors often use the two terms interchangeably.
EASM stands for external attack surface management. It starts from a domain or company name and maps what is visible from the internet, with nothing installed on your network.
IASM stands for internal attack surface management. It maps devices, accounts and services inside a network, usually with agents or sensors, to show what an attacker could reach after getting in.
It depends on who will run the tool. Large security teams often choose enterprise platforms. Small teams do better with a platform that needs no installation and gives plain results. Engineers who like to build their own can combine open-source tools. The table in this guide compares the three approaches.
No. Attack surface management finds and maps what is exposed. A penetration test is a person trying to break in, to prove what an attacker could do. The two work well together: discovery shows where to look, and testing shows what can be used.
See what you have online. And what changed.
Map the subdomains, hosts, open ports and certificates anyone online can reach, then compare scans to see what is new. Nothing is attacked and nothing is installed.