Attack Surface Management (ASM and EASM)

What Is Attack Surface Management?

Attack surface management is a loop, not a one-off audit. It keeps a current list of what can be attacked, checks each item for weak points and sends the worst ones to the people who can fix them. Then it starts again, because the list changes every week.

NIST calls the attack surface the set of points on a system's boundary "where an attacker can try to enter, cause an effect on, or extract data from" it. ASM turns that boundary into named assets with owners: domains, hosts, cloud accounts, login pages and open services. Here ASM means this digital surface; people, phishing and physical sites belong to the wider meaning in that entry.

Most of the work starts outside the network. That part is external attack surface management (EASM). It looks from the internet inward and needs no access to your systems. Some products sold as ASM cover only this external part, so check which one a tool or a report means.

ASM, EASM, CAASM and CTEM: What Is the Difference?

These terms overlap, and vendors use them loosely. The table puts them next to three older methods that most security teams already run.

The most useful result is often the gap between two lists. Our CAASM vs EASM comparison shows how the inside view and the outside view catch each other's blind spots. The CTEM guide walks through the five stages. If you want discovery run for you all the time, see the Brandefense attack surface management platform.

How Does Attack Surface Management Work?

Discovery starts from seeds: the domains, IP ranges and company names you already know. Microsoft's Defender EASM documentation describes the method as searching recursively for infrastructure through observed connections to known legitimate assets. The asset kinds it lists are domains, IP address blocks, hosts, email contacts, ASNs and Whois organizations.

The cycle that follows has six steps.

1. Collect seeds. List every registered domain, brand, subsidiary, IP range and cloud account you know of. Ask finance and legal about acquisitions, because a bought company brings its own domains.
2. Discover. Follow DNS records, TLS certificates, registration data and internet scan results outward from each seed. Each new link can reveal another asset.
3. Attribute. Record why each asset belongs to you, such as a shared certificate, name server or registrant. Without that proof, teams waste time on assets that are not theirs.
4. Assess. Check each asset for open ports, exposed admin pages, software versions, expired certificates and known vulnerabilities.
5. Prioritize. Rank findings by exposure, by the value of the asset and by whether the flaw is being exploited. A flaw listed in the Known Exploited Vulnerabilities catalog goes near the top.
6. Fix and check again. Send each finding to a named owner. Then scan again to confirm the fix and to catch new assets.

Our vulnerability prioritization entry explains how to rank the findings from step five.

Where Does Discovery Find Assets Nobody Listed?

An attacker reads public records first, because they are free and leave no trace on your systems. You can read the same records.

Certificate transparency is the richest of these. RFC 6962 describes it as publicly logging TLS certificates "as they are issued or observed", in logs that are append-only and open to anyone. A host name stays in the logs after the server is gone, which makes them good for finding forgotten sites.

The four checks below read only public records and one normal web response. We ran them against example.com on 10 November 2026. Swap in a domain you own.

# 1. Host names seen in certificate transparency logs
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u

# 2. Where a host points (look for aliases to services you no longer use)
dig +short A example.com
dig +short CNAME www.example.com

# 3. Registration data: registrar, name servers, status
curl -sL https://rdap.org/domain/example.com

# 4. Which server software a site announces
curl -sI https://example.com | grep -i -E '^(server|x-powered-by):'

Run active scans, such as port scans, only against systems you own or have written permission to test. For a quick outside view of one domain, try our free domain scanner. It builds a risk score from breach data, infostealer logs, dark web mentions and phishing domains in about 30 seconds.

What Does an Attack Surface Usually Expose?

Most findings are plain. None of them needs a clever attacker; they only need to be found. The table lists common exposures, an example of each and the first step to take.

A dangling record can lead to a subdomain takeover, where an outsider serves content under your name. Systems that IT never approved, known as shadow IT, show up in every row of this table. Removing what nobody needs is attack surface reduction, often the cheapest fix of all.

What Does Brandefense Data Show About Exposed Systems?

Two of our own data sets look at the same problem from opposite sides. One shows what criminals sell. The other shows what websites reveal to anyone who asks.

What Access Sellers Advertise

For the Cybercrime Report 2026 initial access chapter, we read 120 corporate network access listings in Brandefense Blackhole posts dated 1 January to 27 October 2026. Counting one repeated firewall template once, 48 of 106 offers (45%) named a firewall, network device, Citrix, Fortinet, RDP, VPN or RDWeb.

Every field in those listings is a seller's claim, and 120 is a lower bound, not a market size. The method is in our anatomy of a corporate network access listing.

A separate sample from the same report looked at access offers of every kind, not only corporate ones. Footholds on websites and servers dominated it. Of 44 sampled offers from January to August, 23 were web shells and seven were RDP.

What Websites Show From Outside

Our free PHP2Shell check ran 40,849 times on 30,027 different sites between 21 and 25 October 2026 (Brandefense Atlas, counts only). The PHP version was readable in the response headers of about 12% of the sites, or 3,532. Of those, 2,071 (59%) showed a version older than the fixed releases, and 1,157 ran a branch that has reached end of life.

Visitors chose what to check, so this is not a random sample of the internet. Most sites hide the version, and a hidden version is not a safe one. The full numbers are in our PHP2Shell analysis.

Both data sets point at things an outside scan can see: a management page, a remote access gateway, a version banner. That is the part of the attack surface to map first. The people who buy and sell such footholds are described in our initial access broker entry.

Why Does EASM Matter?

You cannot fix an asset you do not know about. Mergers, cloud projects and regional offices create systems that head office never hears of. A test server in Singapore or a forgotten site in Poland is as reachable as the main website.

Attackers go for these gaps. The Verizon 2026 Data Breach Investigations Report says exploiting vulnerabilities is now the most common way in. It accounts for 31% of the breaches where the entry point was known, while credential abuse fell to 13%.

Fixing is getting slower, too. In Verizon's data, organizations fully fixed only 26% of the critical flaws listed in CISA's KEV catalog in 2025, down from 38% the year before. The median time to a full fix rose from 32 to 43 days.

Management interfaces are a repeat target. Palo Alto Networks Unit 42 reported on 29 October 2026 that PHP2Shell was being exploited against PAN-OS management interfaces exposed to the internet. Our PHP2Shell analysis records the details. A current list of every such interface tells you where to look first.

How Often Should Attack Surface Management Run?

Run discovery all the time if you can, and at least once a week. CISA's Binding Operational Directive 23-01 gives a useful yardstick. Since 3 April 2023 it has required US federal civilian agencies to run automated asset discovery every 7 days, covering at least their whole IPv4 space. They must also start vulnerability enumeration across all discovered assets every 14 days.

BOD 23-02, issued on 13 June 2023, covers management interfaces on routers, switches, firewalls, VPN concentrators, proxies, load balancers and out-of-band server management. Within 14 days of finding one, an agency must take it off the internet or put access behind a separate policy enforcement point. Both directives bind only US federal civilian agencies. For everyone else they are a fair benchmark, not a rule.

How Do You Start an Attack Surface Management Program?

A first cycle fits into about a month with the tools most teams already have. This plan assumes a small team and a list of domains to start from.

1. Week 1, seeds and owners. Collect every domain, brand, subsidiary, IP range and cloud account. Name one owner for each business unit.
2. Week 2, discovery. Read certificate logs, DNS and registration data for each seed, and add what an outside scan finds. Mark every asset you did not know about.
3. Week 3, the short list. Fix four things first: management interfaces on the internet, remote access gateways with KEV-listed flaws, end-of-life software and DNS records that point at deleted resources.
4. Week 4, the routine. Give every asset an owner, set a weekly discovery cycle and send findings into the ticket system the owners already use.

Report a few numbers each month. Track unknown assets found, the share of assets with a named owner and the median days to close a critical external finding. Add the count of management interfaces reachable from the internet, which should be zero. Verizon's 43-day median gives you an outside yardstick for the time to fix.

What Should an Attack Surface Management Tool Show You?

• Why each asset is linked to you, so you can trust the result.
• Who owns the asset inside your company.
• What changed since the last scan, including new hosts and newly opened services.
• A ranked list with the reason for each rank, such as a KEV-listed flaw or an exposed admin page.
• A way to send findings to the tools your team uses, such as a ticket system or an API.

Our attack surface management buyer's guide turns these points into questions for vendors. For the outside view in plain steps, read External Attack Surface Management 101. Brandefense External Attack Surface Management scans an organization's internet-facing assets within minutes.