Glossary
External Attack Surface Management (EASM)
Continuous discovery and monitoring of everything an organization exposes to the internet, from an attacker's viewpoint, without agents or credentials.
Definition
External Attack Surface Management (EASM) is the practice of continuously discovering, inventorying and monitoring every internet-facing asset an organization owns or depends on: domains, subdomains, IP ranges, hosts, open services, TLS certificates and the software running behind them. Unlike traditional vulnerability scanning, EASM starts with no assumed inventory. It builds the asset list the way an attacker would, from public sources such as DNS records, certificate transparency logs, WHOIS data, routing information and internet-wide scans.
The reason EASM exists as its own category is simple: most organizations do not have an accurate, current inventory of their own external footprint. Mergers, acquisitions, shadow IT, forgotten test environments, contractor-managed subdomains and cloud sprawl all create assets that security teams never explicitly provisioned and therefore never explicitly secured. An EASM platform closes that gap by re-discovering the environment on a recurring basis rather than relying on a manual asset register that goes stale within weeks.
A mature EASM program does more than list assets. It fingerprints the technology stack behind each exposed service, matches versions against known vulnerability databases, flags expired or misconfigured certificates, and surfaces exposed administrative panels, open databases and leaked credentials tied to the organization's domains. Findings are typically prioritized using a combination of exploitability signals, such as inclusion in the CISA Known Exploited Vulnerabilities catalog, and business context, such as whether the asset sits on a production domain or a long-abandoned subdomain.
EASM is increasingly required rather than optional. Regulations such as DORA and NIS2 expect financial and essential entities to maintain an accurate, current view of their ICT footprint and third-party dependencies, and frameworks like NIST CSF 2.0 explicitly call out asset inventory as a foundational control. Because EASM is agentless and works entirely from outside the network, it also gives a fast, unbiased view of supplier and subsidiary exposure without needing access to their internal systems, which makes it a natural input to third-party risk programs and continuous attack surface reduction efforts.
In practice, EASM output feeds directly into a company's overall risk posture: newly discovered assets get triaged, high-severity exposures get routed to the teams that own them, and the resulting evidence trail (dated findings, remediation status, historical exposure trends) becomes something a CISO can show a board or an auditor as proof that the external surface is actively managed rather than assumed to be safe.
Common questions
How is EASM different from a vulnerability scanner?
A vulnerability scanner tests a known list of targets you give it. EASM first discovers the list of targets itself, using public sources, and then continuously re-discovers it, which is what catches assets nobody remembered to add.
Does EASM require credentials or agents?
No. EASM works entirely from outside the network using publicly observable information, which is what makes it usable against third parties, subsidiaries and newly acquired companies without needing their cooperation.
How often should an EASM scan run?
Continuously or near-continuously. Attack surfaces change daily through new deployments, expiring certificates and DNS changes, so a quarterly snapshot misses most of the exposure window that matters.