Glossary
Attack Surface Management (ASM)
The broader discipline of inventorying, monitoring and reducing every way an organization can be attacked, of which external management is one half.
Definition
Attack Surface Management (ASM) is the overarching discipline of understanding everything that could give an attacker a foothold into an organization: internet-facing systems, internal assets, cloud resources, identities, and the software supply chain behind all of them. It is broader than any single tool category. Vendors typically split ASM into two complementary halves: External Attack Surface Management (EASM), which discovers and monitors what is visible from the public internet, and Cyber Asset Attack Surface Management (CAASM), which aggregates internal asset data already sitting in existing tools such as CMDBs, cloud consoles and endpoint agents.
The core problem ASM addresses is drift. Environments change constantly through new deployments, decommissioned services that were never fully removed, contractor access, and cloud resources spun up outside normal change control. Static, periodic assessments cannot keep pace with that rate of change, so ASM platforms are built around continuous re-discovery and change detection rather than point-in-time snapshots.
A functioning ASM program answers three questions on an ongoing basis: what do we own, what state is it in, and what has changed since the last look. Answering the first question well requires casting a wide net for discovery, since assets acquired through mergers, spun up by business units, or left behind by former employees rarely appear in an official inventory. Answering the second requires enriching each asset with technology fingerprints, certificate status, exposed services and known vulnerabilities. Answering the third requires storing history so that a new open port, a newly expired certificate, or a newly exposed admin panel is flagged as soon as it appears rather than discovered months later during an incident.
ASM programs typically prioritize findings using a mix of exploitability data (for example, whether a vulnerability appears in the CISA KEV catalog or has a high EPSS score) and business context, such as whether the asset is internet-facing, customer-facing, or tied to a critical business process. This prioritization is what separates a useful ASM program from a noisy list of theoretical issues that security teams learn to ignore.
Because ASM produces a dated, evidence-backed view of exposure over time, it has become a common input to compliance programs under frameworks like NIST CSF 2.0, ISO 27001 and DORA, all of which expect organizations to demonstrate an accurate and current asset inventory rather than an annual, manually maintained spreadsheet.
Common questions
Is ASM the same as EASM?
EASM is the external half of ASM. ASM as a category also includes internal asset aggregation (CAASM), though many teams use the terms interchangeably when they mean the external, agentless view.
Why does ASM matter for supply chain risk?
Because ASM works without credentials, it can be pointed at vendors and subsidiaries just as easily as at your own domains, giving you an outside-in view of third-party exposure without needing their cooperation.
What is the output of an ASM program?
A living, dated inventory of assets and exposures, prioritized findings routed to asset owners, and a historical record that shows whether exposure is trending up or down over time.