CAASM and EASM answer the same question from two sides. Cyber asset attack surface management (CAASM) builds an inventory from the tools a company already runs, so it sees the inside. External attack surface management (EASM) starts from the internet and finds what answers there, so it sees what an attacker sees. Each one misses what the other catches.
CAASM reads your own tools and knows internal assets and their owners. EASM looks in from the internet and finds exposed assets that no tool listed. Most teams need both, and the most useful output is the difference between the two lists.
What Are CAASM and EASM?
Both terms sit under attack surface management. The attack surface is every point an attacker could use to get into a system or take data out of it.
CAASM connects to tools through their APIs. Typical sources are endpoint detection and response (EDR), the configuration management database (CMDB), cloud accounts, identity systems, device management and vulnerability scanners. It merges what they report into one list and shows where they disagree.
EASM needs no access inside the network. It starts from a company’s names, domains and IP ranges. Then it follows DNS records, certificates and internet scans to find everything that answers. Brandefense works on this side: our External Attack Surface Management scans an organisation’s internet-facing assets within minutes.
What Can Each View See, and What Does It Miss?
The table puts one question per row. The middle column is the inside view, the right column the outside view.
| Question | CAASM (inside view) | EASM (outside view) |
|---|---|---|
| Where does the data come from? | From the tools you already run, read through their APIs. | From the internet: DNS, certificates, IP ranges and scans. |
| Does it need access inside? | Yes, one integration per tool. | No, it starts from names and domains. |
| Internal servers and laptops. | Seen if any connected tool knows them. | Not seen. |
| A subdomain pointed at a vendor’s host. | Missed unless a tool lists it. | Found through DNS and certificates. |
| Open ports, versions and certificates. | Not shown as an attacker sees them. | Shown, since this is what a scan reads. |
| Who owns the asset? | Often known from CMDB or identity fields. | Rarely known; a scan finds a host, not an owner. |
| A device with no EDR agent. | Shown by joining two sources. | Not visible from outside. |
| Typical false result. | Old CMDB rows copied in as they are. | Hosts that look like yours but belong to someone else. |
Read each row as a question about one asset. Where one column says “not seen”, the other column is your only source. Where both columns have an answer, compare them, because a mismatch is a finding.
Three Assets That Show Up in Only One List
These are common patterns, not cases from a named company. Each one shows why a single inventory is not enough.
A Campaign Site on an Agency’s Host
An agency builds a landing page on its own hosting, and someone points a company subdomain at it. The campaign ends, the DNS record stays, and the site stops getting updates. No EDR, CMDB or cloud account knows about it, so CAASM has nothing to merge. An outside scan finds the subdomain and the old software behind it.
The NCSC warns about this route. Its asset management guidance says procurement records “may not identify assets obtained freely, or through non-standard procurement routes”. Our post on how shadow IT grows the external attack surface covers more of these routes.
A Branch Office File Server
A file server sits in a branch office. It is in the CMDB and the vulnerability scanner lists it, but it has no public IP address or DNS name. EASM never sees it. CAASM sees it and, by joining sources, can show that it has no EDR agent.
A Test Server in an Unconnected Cloud Account
A team opens its own cloud account for a project and starts a test web server. CAASM sees it only if someone connected that account as a source. EASM finds it only if a DNS name or certificate leads back to the company. If neither holds, both lists miss it, and only a third check such as cloud billing will catch it.
What Do CISA, NCSC and CIS Say About Asset Discovery?
None of these bodies tells companies to buy a CAASM or EASM tool. They do say that asset lists must be kept current and tested, and CISA asks for automated discovery. That is the job both views share.
- CISA BOD 23-01. Issued on 3 October 2022 for US federal civilian agencies, it says to “perform automated asset discovery every 7 days” and to run vulnerability enumeration every 14 days. Discovery must cover at least “the entire IPv4 space used by the agency”.
- The scope has gaps. CISA’s implementation guidance leaves out “ephemeral assets such as containers and third-party managed software as a service (SaaS) solutions”. Even a federal rule leaves work for a second source.
- CISA Cyber Hygiene. This CISA service is a government version of the outside view. It monitors “internet-accessible network assets (public, static IPv4 addresses)” and sends weekly reports of its findings.
- NCSC. The UK agency tells organisations to “recognise that you are unlikely to have a complete understanding of your organisation’s assets”. It also advises them to “reconcile procurement records and cloud billing with asset records”.
- CIS Control 1. The first CIS Critical Security Control asks for an active inventory of all enterprise assets, including those in cloud environments. It also aims at “identifying unauthorized and unmanaged assets to remove or remediate”.
Which View Should a Small Team Start With?
Start where your blind spot is larger. A company with many tools but little idea of its internet footprint gains most from the outside view. It needs no integrations, and it shows first what an attacker would find first.
A company with a small, well known web presence but many devices gains more from joining its inside tools. That is where missing agents and unknown owners show up.
Either way, the second view is what tests the first. The NCSC asks teams to “have a plan to validate your asset management system”. A list that is checked only against itself cannot tell you what it misses. Our attack surface management buyer’s guide lists the questions to ask a vendor on either side.
What Should Happen When an Asset Is in Only One List?
Treat every mismatch as a small case with an owner and an end date. This order works for both directions.
- Confirm the asset is yours. Check DNS, certificate and hosting records first, because shared hosting and look-alike names cause false matches.
- Find an owner who can say why it exists. An asset without an owner is the riskiest kind.
- Decide to keep it or retire it. Keep means an inventory record, an agent where possible and a patch plan. Retire means removing the DNS record or closing the account.
- Fix the route it came in by. Ask why the inventory missed it: an agency, a free sign-up or a personal card.
- Check it again on the next discovery run.
The retire step is where the attack surface actually shrinks. Our page on attack surface reduction covers it in more depth, and the asset discovery and shadow IT use case shows how the outside view feeds this loop.