What Is Attack Surface Management?
Attack surface management continuously discovers and monitors all internet-facing assets to identify unknown exposure.
What Attack Surface Management Evaluates
External Attack Surface
The external attack surface includes all assets accessible from the internet: web servers, APIs, email servers, VPN appliances, remote desktop gateways, cloud storage buckets, subdomains, and any other internet-facing resource. ASM platforms continuously discover and monitor these assets, identifying the IP addresses, domains, and services that an external attacker can reach before gaining any network access.
Shadow IT — cloud services, applications, and infrastructure deployed by business units without IT knowledge or approval — is a persistent problem in external attack surface management. A development team that spins up an AWS instance for testing purposes, an employee who registers a company-branded domain for a side project, or a business unit that deploys a SaaS application without IT review all create external attack surface that the IT and security team does not know about and therefore cannot manage. ASM platforms discover these assets through DNS enumeration, certificate transparency log analysis, and internet scanning rather than relying on the organization's own asset documentation.
Certificate Transparency and Subdomain Discovery
Certificate Transparency logs — public records of all SSL/TLS certificates issued by certificate authorities — provide a comprehensive view of an organization's internet-facing assets that goes beyond what internal asset management systems document. Every subdomain for which a certificate has been issued appears in CT logs, including subdomains of cloud services, development environments, and third-party providers that use the organization's domain names.
Continuous vs. Point-in-Time Assessment
Traditional security assessments — penetration tests, vulnerability scans — provide a point-in-time view of attack surface. The internet-facing attack surface changes continuously: new services are deployed, cloud instances are spun up, developer testing environments are created. A penetration test conducted in January does not reflect the attack surface in March.
ASM platforms provide continuous monitoring that discovers new assets and vulnerabilities as they appear, rather than waiting for the next scheduled assessment. When a new internet-facing service is deployed, ASM identifies it within hours. When a new vulnerability is disclosed in a technology the organization uses, ASM identifies which internet-facing assets run that technology and are affected. This continuous visibility reduces the window between asset creation or vulnerability disclosure and security team awareness.
ASM for PE Due Diligence
Attack surface management has specific value in M&A due diligence contexts. An ASM scan of an acquisition target's external attack surface — conducted using only publicly available information, requiring no cooperation from the target — reveals the internet-facing technology environment, identifies exposed systems running vulnerable software, discovers shadow IT and forgotten assets, and provides a realistic picture of the external exposure an acquirer will inherit.
Cloudskope conducts external attack surface assessments as standard components of pre-close M&A cyber due diligence, identifying the internet-facing exposure of acquisition targets and quantifying the remediation investment required to bring that exposure within acceptable risk parameters. These assessments consistently surface findings not documented in the target's own asset inventories — because the assets were never added to those inventories.
Related Reading
Frequently Asked Questions
What is the difference between ASM and vulnerability management?
Vulnerability management identifies known vulnerabilities on known assets — it requires a complete asset inventory as input. ASM addresses the problem that organizations do not have complete asset inventories: it continuously discovers internet-facing assets the organization doesn't know about, then identifies the vulnerabilities on those discovered assets. ASM is the asset-discovery layer that makes vulnerability management actually comprehensive rather than limited to documented systems.
What is shadow IT and how does ASM find it?
Shadow IT is cloud services, applications, and infrastructure deployed by business units without IT knowledge or approval. ASM platforms discover it through DNS enumeration, certificate transparency log analysis, internet scanning, and cloud provider API integration. A development team's forgotten AWS instance, a marketing team's unauthorized SaaS subscription, or an employee's company-branded side project all appear in ASM results regardless of whether they appear in the organization's own asset registers.
How does ASM discover unknown assets?
Certificate Transparency logs provide a comprehensive view of subdomains where certificates have been issued. DNS enumeration discovers active subdomains and their associated services. Internet-wide scanning data from Shodan, Censys, and proprietary scanners reveals which IP addresses run which services. WHOIS records and BGP data identify network ranges associated with the organization. ASM platforms combine these sources to build attack surface maps far more complete than internal documentation.
What are the leading ASM platforms?
Microsoft Defender External Attack Surface Management (acquired from RiskIQ), Palo Alto Cortex Xpanse, and CrowdStrike Falcon Surface are the established enterprise platforms. Censys and Shodan provide the underlying internet-scanning data that many ASM platforms consume. Bishop Fox CAASM, Axonius, and runZero address the related cyber asset attack surface management category. Selection depends on whether the priority is external attack surface, internal asset attack surface, or both.
How is ASM different from a penetration test?
A penetration test is a point-in-time assessment that includes attempted exploitation of identified vulnerabilities — it produces a detailed report of what an attacker could actually do. ASM is continuous monitoring that produces a real-time inventory of internet-facing exposure without active exploitation. They are complementary: ASM identifies what should be tested; penetration testing validates whether identified exposure can be exploited.
How often should ASM scans run?
Continuously. The internet-facing attack surface changes continuously — new cloud instances are deployed, developer environments are created, certificates are issued, services come online. Modern ASM platforms operate continuously rather than on scheduled cycles, alerting security teams to new assets, new vulnerabilities on existing assets, and significant attack surface changes within hours rather than weeks. Quarterly or annual ASM assessments miss most of the assets that matter.
What is the difference between EASM and CAASM?
EASM (External Attack Surface Management) focuses on internet-facing exposure — what an external attacker can see and reach. CAASM (Cyber Asset Attack Surface Management) provides comprehensive internal asset visibility — every device, application, and identity within the organization, including assets that are not internet-facing. Most organizations need both: EASM addresses the external attack surface that initiates breaches; CAASM addresses the internal asset visibility that determines how quickly an internal breach is detected and contained.
Real-World Example: Microsoft Exchange Server Exposure — ASM Revealed the Scale
When the Microsoft Exchange zero-days were disclosed in March 2021, organizations that had deployed Attack Surface Management platforms were able to immediately identify which of their internet-facing Exchange servers were unpatched and vulnerable. Organizations without ASM had to manually inventory Exchange deployments, a process that took days in complex environments and often missed forgotten instances. CISA's internet-wide scanning found hundreds of thousands of vulnerable Exchange servers worldwide — organizations with continuous ASM identified their exposure in hours; others discovered it from CISA notification days or weeks later.
Of internet-facing assets in the average enterprise are unknown to the IT and security team — meaning nearly one in three internet-facing systems operates without security monitoring, patching, or access control oversight.