In the first two articles of this series, we looked at the beginning of an attack from two perspectives.
First, we thought like an attacker: before attempting to compromise an organization, an attacker can research what is available on the Internet and build a map of its attack surface.
Then, we looked at the data. Recent reports from Verizon, Mandiant, IBM X-Force, and ENISA show that the exploitation of vulnerabilities and externally accessible systems plays an important role in the early stages of real-world attacks.
This leads us to an inevitable question:
If an attacker can discover and analyze our external attack surface, can we see it in the same way?
This need lies at the heart of Attack Surface Management (ASM).
Before you can protect it, you need to know it exists
Every organization has digital assets.
Domains, subdomains, websites, applications, APIs, IP addresses, cloud infrastructure, remote access services, and different technologies are all part of today’s technology environment.
The problem is that the environment known to the organization does not always correspond exactly to what can be discovered on the Internet.
New systems go into production. Temporary environments are created. Projects are discontinued. Companies are acquired. Services migrate to the cloud. New vendors become part of the ecosystem.
And some assets simply stop being monitored.
This is how unknown, forgotten, or unmanaged assets can emerge.
For an attacker, however, there is a fundamental difference:
An asset does not need to be in the organization’s inventory for an attacker to find it.
If it is externally accessible, it can become part of the surface they observe.
What is Attack Surface Management?
Simply put, Attack Surface Management is the continuous process of discovering, identifying, monitoring, and analyzing the assets and exposures that make up an organization’s attack surface.
When this process focuses specifically on the organization’s Internet-accessible presence, the term External Attack Surface Management (EASM) is widely used.
The central idea is to view the organization from the outside in.
Instead of starting exclusively with the internal inventory and asking:
“What assets do we have?”
The perspective shifts to:
“What can someone on the outside — an adversary — discover that is associated with our organization?”
This may seem like a small difference, but it significantly changes the starting point.
EASM aims to discover, inventory, and monitor the digital assets that make up an organization’s external presence, including unknown or unmanaged resources, providing a view of the infrastructure from an external perspective.[1][2]
The known inventory does not necessarily tell the whole story
Imagine an organization whose official inventory contains 100 external assets.
The organization monitors these assets, performs vulnerability assessments, and tracks updates.
But there is an earlier question:
Are these really all the assets that can be discovered externally?
There may be a subdomain created by another business unit.
An old application that remained online after a project ended.
An IP address associated with infrastructure that is no longer documented.
A cloud environment created to address a specific business need.
An application from an acquired company that still uses its original infrastructure.
Or an external service that was never included in the formal management process.
This phenomenon is often associated with Shadow IT, but it is not limited to it. Organizational changes, growth, acquisitions, decentralized technology management, and the speed at which digital infrastructure is created can expand the external attack surface without every element immediately reaching the central inventory.
This is precisely why the discovery of unknown assets is an important capability within EASM.[2]
Discovery starts with what we already know
How do you discover something you do not know exists?
The process typically begins with some known information about the organization.
For example:
- Domains.
- IP addresses and IP ranges.
- Hosts.
- ASNs.
- Registration information and other infrastructure relationships.
These elements can serve as starting points for discovery.
From there, externally available technical relationships can reveal new assets associated with the organization.
A domain can lead to subdomains.
A digital certificate can reveal other hosts.
An IP address can be associated with different services.
Registration records and infrastructure relationships can lead to other elements.
These new discoveries can, in turn, reveal additional relationships.
This is how the process begins to build something very similar to what we described in the first article:
A map of the organization’s attack surface.
The discovery process can start from known assets and progressively expand this view through identified relationships, revealing infrastructure that may previously have been unknown or unmonitored.[2]
Discovery is only the first step
Finding an asset does not necessarily mean that a risk exists.
An application published on the Internet may be there because it needs to be accessible.
The purpose of ASM is not to treat every exposure as a vulnerability.
The next step is to understand what exists on that asset and how it is exposed.
For example:
- Which services are accessible?
- Which technologies are being used?
- Are there known vulnerabilities?
- Are there misconfigurations?
- Are administrative interfaces exposed?
- Does the asset use insecure protocols or configurations?
- Are sensitive services externally accessible?
- Should the asset still be publicly accessible?
This is where the inventory begins to gain exposure context.
CISA recommends that organizations identify which assets are accessible from the Internet, assess whether that exposure is actually necessary, and, for those that need to remain exposed, identify and mitigate the associated risks.[3]
And the attack surface changes
There is another challenge that makes the concept of Management particularly important.
The attack surface is not static.
Today, an organization may have a certain set of external assets.
Tomorrow, a new API is published.
Next week, a new cloud environment goes into production.
A vendor changes a configuration.
A new subdomain is created.
A service that was previously restricted becomes accessible from the Internet.
Or a new vulnerability is discovered in a technology that was already exposed.
For this reason, performing discovery only once provides nothing more than a snapshot of that particular moment.
Attack Surface Management needs to be continuous because the attack surface itself changes continuously.
Discovering and monitoring these changes allows the organization to maintain a more up-to-date view of its external presence and the relationships between the assets that make up that presence.[2]
ASM is not simply a vulnerability scanner
This distinction is important.
A vulnerability scanner and ASM can work in complementary ways, but they start with different questions.
In a traditional vulnerability management process, there is typically a defined set of assets to be assessed:
“Analyze these systems and identify their vulnerabilities.”
With ASM, there is an earlier question:
“Which systems exist and can be discovered externally?”
Only after discovering and understanding this surface is it possible to more comprehensively analyze the vulnerabilities and other exposures that exist across it.
CISA also conceptually distinguishes asset discovery from vulnerability enumeration: first, existing assets are identified; then their attributes, versions, configurations, and associated vulnerabilities can be analyzed.[4]
This distinction is fundamental:
You cannot assess what you do not even know exists.
From visibility to action
Discovering hundreds or thousands of assets and exposures, however, creates another problem.
What should be addressed first?
A long list may increase visibility, but it does not necessarily improve decision-making.
That is why discovery and monitoring of the attack surface need to be accompanied by context. Information about assets, vulnerabilities, configurations, exposed services, and other signals helps determine which exposures deserve greater attention.
The goal is not simply to increase the amount of information available, but to turn visibility into decision-making capability.
And this is where we begin to reach another important evolution.
Because discovering the attack surface is essential.
Continuously monitoring it is essential as well.
But seeing does not necessarily mean understanding the actual risk each exposure represents to the business.
A critical vulnerability in one asset may require immediate attention.
Another exposure may appear technically less severe but be associated with a sensitive system or provide a relevant opportunity within an attack chain.
This is where the discussion begins to move from Attack Surface Management toward something broader:
Cyber Exposure.
But that will be the topic of our next article.
Seeing like an attacker
Our starting point in this series was simple:
An attacker does not see the organization through its internal inventory. They see what the Internet reveals.
Attack Surface Management seeks to reduce this gap in perspective.
Discover what is exposed.
Identify assets that may not have been monitored.
Understand how they are accessible.
Monitor changes.
And turn this visibility into information that enables action before an exposure becomes an attack opportunity.
Because when it comes to the attack surface, there is one question no organization should leave for the attacker alone to answer:
How are you managing your organization’s attack surface?
References
- Gartner — External Attack Surface Management (EASM) Market Definition
- Microsoft Learn — Defender External Attack Surface Management: Discovery
- CISA — Internet Exposure Reduction Guidance
- CISA — BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks
Continue exploring
- How Does a Cyberattack Begin?
- External Attack Surface: What Recent Data Reveals About How Attacks Begin
- Attack Surface Management, Offensive Validation
- External attack surface: 7 blind spots that increase exposure
Want to bring this perspective to your attack surface?
See how Lion Focus helps discover, monitor, validate, and prioritize cyber exposures.
Leonnes Cybersecurity
Cyber Exposure Platform
