External Attack Surface Management (EASM) is the discipline of continuously discovering, inventorying, and monitoring all the assets an organization exposes to the public internet, starting from its root domain and without the installation of agents, attributing each asset to the organization that owns it and classifying the associated exposures. EASM builds the view of what an adversary observes when it examines the organization from the outside.
An organization's external attack surface comprises the set of systems, services, and interfaces reachable over the public internet: web applications, APIs, remote access portals, mail servers, staging environments published by mistake, administrative panels, and cloud-provisioned assets. This surface grows with each project, acquisition, and configuration change. EASM maps this set continuously and keeps it up to date, giving the organization the same perspective the adversary adopts when selecting its entry point.
What EASM Discovers and Why the External Perspective Matters
The adversary begins reconnaissance without any internal knowledge of the organization. It starts from a public identifier — a domain name, a brand, a block of addresses — and expands from there until it composes the inventory of reachable assets. EASM reproduces this same movement systematically and in the service of defense: the organization comes to see its exposure through the lens of the party that attacks it.
This external perspective reveals what internal inventories frequently omit. An asset published by a business unit without passing through the formal provisioning process does not appear in the configuration management spreadsheet, and yet it is exposed. A subdomain inherited from a closed marketing campaign continues responding on the internet long after the responsible team has dispersed. EASM finds these assets because it does not depend on internal knowledge: it depends only on what is observable from the outside, which is exactly what the adversary also observes.
The starting point is the root domain. From it, discovery expands through subdomains, associated network records, certificates, cloud services, and other artifacts publicly correlatable to the organization, until it composes a comprehensive inventory of the external presence. This entire process occurs without agents installed on the assets and without access credentials, which makes it possible to discover even the assets the organization did not know it owned — precisely the ones that represent the greatest risk because they lie outside any management process.
EASM, Traditional Scanners, and Vulnerability Management
EASM occupies a position distinct from the tools with which it is frequently confused. The distinction lies in the starting point of each approach.
What Distinguishes EASM from a Vulnerability Scanner
A traditional vulnerability scanner operates on a known list of targets. The organization provides the addresses to examine, and the scanner evaluates each one in search of cataloged weaknesses. The scanner's premise is that the inventory of targets already exists and is correct. This premise is precisely what fails in practice: the organization cannot examine the asset it does not know it owns.
EASM inverts the order. It begins with discovery — determining which assets exist — and only then evaluates the exposures of each one. The question EASM answers first is "what does the organization expose to the internet," and only afterward "what weaknesses does that exposure present." A scanner answers the second question assuming the first has already been resolved.
The Relationship with Vulnerability Management
Traditional vulnerability management concentrates on known and mostly internal assets, handling the cycle of identification, prioritization, and correction of weaknesses in those systems. EASM complements this discipline by covering the external boundary and, above all, by resolving the coverage problem: it ensures that the inventory on which vulnerability management acts in fact encompasses everything that is exposed. Attack surface management (ASM) integrates the two views, unifying continuous external discovery with the assessment and treatment of the exposures found.
Attribution and Classification: Turning Discovery into an Actionable Inventory
Discovering an asset is the first step. An inventory only becomes actionable when each discovered asset is associated with the correct organization and classified by nature and criticality.
Attribution. Determining that an asset in fact belongs to the organization — and not to a namesake or an unrelated third party — is a step that requires rigor. Loose attribution inflates the inventory with assets that are not the organization's, generating treatment effort on others' targets. Strict attribution, by contrast, leaves out legitimate assets and reproduces the blind spot that EASM sets out to eliminate. Precise attribution correlates multiple public indicators to establish the ownership of each asset with confidence, distinguishing what belongs to the organization from what merely resembles it.
Classification. Each attributed asset receives a characterization: its technical nature, the service it exposes, the environment it belongs to, and its relevance to the business. This classification is what allows the inventory to be ordered by criticality rather than treated as a uniform list. An authentication portal that grants access to customer data requires attention distinct from that of a static institutional page, even though both are legitimate external assets.
The quality of attribution and classification determines the value of the entire program. A comprehensive but poorly attributed inventory produces noise; a well-attributed inventory without criticality classification produces a list that no one can prioritize. CSURFACE's discovery process was designed to deliver both properties: comprehensiveness in discovery and precision in attribution.
Shadow IT and Subsidiaries: Where the Internal Inventory Fails
Two categories of assets systematically escape internal inventories, and they are precisely the ones EASM recovers.
Shadow IT comprises the assets provisioned outside the formal technology processes — the environment a product team spins up in the cloud for a proof of concept, the subdomain an agency publishes for a campaign, the service an employee exposes to address a one-off need. None of them passes through configuration management, and all of them remain exposed. Because they are defined by the absence of an internal record, these assets can only be found through external observation.
Subsidiaries and acquisition inheritance compose the second category. An organization that grows through acquisition inherits the attack surface of each incorporated company, frequently without a consolidated inventory of that inheritance. Domains, brands, and network blocks of acquired entities become the responsibility of the acquiring organization, even though they were never inventoried by it. EASM starts from the group's structure of domains and brands to reconstruct this inherited surface and attribute it correctly to the conglomerate.
In both categories, the value of EASM lies in making visible what the organization did not know was under its responsibility. The unknown asset is the one that presents the greatest risk, because it receives no maintenance, is not monitored, and figures in no response plan.
EASM as the Foundation of a CTEM Program
The Continuous Threat Exposure Management (CTEM) framework, formulated by Gartner, organizes exposure management into a cycle of five phases: scoping, discovery, prioritization, validation, and mobilization. The first two phases depend directly on the capability that EASM provides.
The discovery phase of CTEM requires a comprehensive and up-to-date inventory of the assets and their exposures. Without continuous discovery of the external surface, the scope of the program rests on an incomplete inventory, and all subsequent phases inherit that gap. EASM is the mechanism that feeds discovery with the current reality of the organization's external presence.
The prioritization phase consumes the classification produced by EASM. Ordering exposures by relevance presupposes knowing the criticality of each affected asset — information that the inventory classification provides. A continuous exposure management (CTEM) program that does not have EASM prioritizes over a partial inventory and is unaware of the real criticality of the assets it orders.
CSURFACE's EASM solution was designed to sustain these phases: continuous discovery from the root domain, precise attribution, classification by criticality, and permanent monitoring of the external surface. The result is an inventory that the CTEM program consumes as its foundation, keeping exposure management aligned with the organization's actual state each cycle.
Frequently Asked Questions
What is the difference between EASM and a vulnerability scanner?
A vulnerability scanner examines a previously known list of targets in search of cataloged weaknesses. EASM begins before that: it discovers which assets the organization exposes to the internet from the root domain, attributes each one to the correct organization, and classifies them, only then evaluating the exposures. EASM resolves the coverage problem that the scanner assumes already resolved.
Does EASM require the installation of agents on the assets?
No. EASM operates exclusively from the external perspective, observing what is publicly reachable on the internet, without installed agents and without access credentials. This characteristic makes it possible to discover even assets the organization did not know it owned, which are precisely the ones of greatest risk because they lie outside any management process.
How does EASM help find shadow IT and subsidiary assets?
Because it depends only on external observation, EASM finds assets that appear in no internal inventory — environments provisioned outside the formal process and surfaces inherited from acquired companies. Discovery starts from the group's structure of domains and brands and attributes each discovered asset to the correct organization, making visible what was under the organization's responsibility without its knowledge.
How does EASM relate to Gartner's CTEM framework?
CTEM organizes exposure management into five phases, and EASM sustains those of discovery and prioritization. Continuous discovery of the external surface provides the comprehensive inventory the program requires, and classification by criticality feeds the ordering of exposures. Consult the glossary for the technical terms cited in this article.