CYMULATE · CONTROL AND EXPOSURE
Cymulate tests whether your defensive stack reacts the way it should, running known attack behaviour in a controlled environment. That is legitimate, mature work. This page is about a different question, one that starts outside the perimeter: among the assets answering on the internet, which ones have an open path right now.
TWO DISTINCT QUESTIONS
Breach and attack simulation measures control effectiveness. It answers whether the EDR blocked it, whether the rule fired, whether the SOC saw it. The question is about the defence, and the environment is yours.
The external surface raises a question that passes through no control at all. The asset answering on the internet that nobody inventoried has no EDR to block anything, because nobody knew it existed. CSURFACE starts exactly there: it discovers what answers from the root domain and validates exploitability over what it discovered.
The validation also differs in nature. It is not simulated behaviour against your stack, it is verification on the real asset that the flaw's precondition holds there and that a sequence exists leading to the described effect. When the only way to prove something would be to bring the service down, the item stays recorded as probable and never rises to proven.
Both practices coexist in a mature program. The comparison below is by capability on the external surface, which is this page's cut.
SIDE-BY-SIDE
The reading is by capability. As these are adjacent categories, each column highlights distinct capabilities — and the table records this with honesty.
| Capability | Cymulate | CSURFACE |
|---|---|---|
| Security control validationVerify if firewall, detection and defense respond | Full This is the central objective of the platform: simulating attacks to confirm that existing controls work. |
Limited The scope of evaluation primarily starts from known assets by the team. |
| External surface discoveryMapping exposed assets on the internet | Limited The assessment scope mainly starts from known assets by the team. |
Full Continuous discovery of the external surface is the central objective of the platform, starting only from the root domain. |
| Asset attribution and classificationConfirm ownership and criticality | Does not cover The construction of an attributed and classified inventory is not part of the platform's proposal. |
Full Each asset is attributed to the organization and classified by business criticality through Machine Learning. |
| Shadow IT and subsidiaries coverageAssets outside official inventory | Does not cover The simulation acts on the known environment, not on the discovery of unmanaged assets. |
Full Shadow IT, brands, and subsidiaries enter the scope without prior inventory. |
| Supply chain component coverageThird-party components embedded in assets | Does not cover The mapping of third-party embedded components is not part of the simulation scope. |
Full Third-party components embedded in assets are mapped as part of the exposure. |
| Prioritization by real exploitabilityWhat is being exploited now | Partial The risk reading derives from simulated attack scenarios, not a continuous prioritization of discovered exposure. |
Partial Active validation covers the CVE that already has a detection module built for it, and the finding ships with its proof. Across the rest of the surface the assessment is passive, matching version and configuration. |
| Continuous surface monitoringDetection of changes and new assets | Limited The focus is on executing simulation campaigns, not continuous surveillance of the external surface. |
Full The external surface is continuously re-evaluated with alerts for relevant changes. |
CSURFACE and Cymulate belong to adjacent categories. Cymulate validates if existing controls work; CSURFACE discovers and prioritizes what needs to be protected. The two capabilities are complementary.
WHERE CSURFACE DIFFERENTIATES
Attack simulations operate on the environment that the team believes they know. CSURFACE builds this knowledge: it maps the external surface starting from the root domain and reveals unmanaged assets, shadow IT, and subsidiaries that would otherwise fall outside the scope of any validation.
Each discovered asset is assigned to the organization and classified by criticality through Machine Learning. The result is a prioritizable inventory, where the team addresses first what truly matters to the business, not a sequence of test scenarios.
CSURFACE orders exposure by what is actually exploitable and critical in continuous monitoring of the external surface. The remediation queue follows the current threat scenario instead of relying solely on sporadic simulation campaigns.
FREQUENTLY ASKED QUESTIONS
No, because they address different issues. Cymulate validates whether existing security controls work by simulating attacks. CSURFACE discovers and prioritizes the external attack surface. These are complementary capabilities: one tests defenses, the other reveals what needs to be defended.
An attack simulation runs controlled offensive scenarios to verify if defensive controls respond as expected. Attack surface management discovers, assigns, and prioritizes the exposed assets of an organization. One answers "do defenses work?"; the other answers "what exists to be protected?"
An attack simulation tends to operate on an environment already known by the team. Its primary focus is not building a complete and continuous inventory of the external surface, with property assignment and criticality classification — that is CSURFACE's dedicated focus.
Yes. Without discovery, validation tests controls on a fraction of the real environment. CSURFACE ensures that the entire and prioritized external surface is mapped out for protection; an attack simulation platform validates if controls over it respond appropriately. For more details on your scenario, contact us through the Contact page.
Enter your company's domain and receive an initial analysis of your external exposure. No credit card.
Receive preliminary analysis
