Glossary
Attack Surface Management is the continuous process of discovering, inventorying and securing all of an organisation’s internet-facing assets — from the attacker’s point of view.
Definition
Attack Surface Management (ASM) is the ongoing discovery, inventory, classification and monitoring of every asset your organisation exposes to the internet — domains, IP addresses, cloud services, APIs, applications and more. Unlike traditional vulnerability scanning, which checks a known list of assets, ASM starts from the outside and finds the assets you don’t know about, then continuously assesses them for exposures. It answers two questions: “what do we have exposed?” and “what’s wrong with it?”
Why it matters
Cloud, acquisitions, third parties and shadow IT mean new internet-facing assets appear constantly. Research suggests organisations are aware of only around two-thirds of their real external footprint — the rest is exactly where attackers look first.
Components
Every domain and subdomain tied to your organisation — including marketing microsites, staging environments and domains spun up by teams outside central IT.
Owned and associated IP ranges across providers and regions, including cloud-assigned addresses that change as infrastructure scales up and down.
Public-facing resources across AWS, Azure and Google Cloud — storage buckets, instances, databases and serverless endpoints reachable from the internet.
Known and unknown API endpoints exposed externally, including undocumented, legacy and shadow APIs that connect straight to your data and logic.
Public web apps, customer portals and login pages — each a potential entry point if left unpatched, misconfigured or forgotten.
Certificates across your estate, including expiring, weak or misconfigured TLS that erodes trust, breaks services or signals neglected infrastructure.
Open ports, databases, remote-access and admin interfaces that should never be reachable from the public internet but often are.
Unmanaged infrastructure and forgotten assets — stood up by teams outside IT or inherited through mergers and acquisitions, invisible to traditional inventories.
How it works
Starting from a single seed such as a domain, map your complete internet-facing footprint — domains, IPs, cloud, APIs and certificates — including unknown and shadow assets, with no agents to deploy.
Assess every discovered asset for vulnerabilities, misconfigurations, exposed services and policy violations, enriching each finding with up-to-date threat intelligence.
Cut through the noise with risk-based scoring that weighs exploitability, exposure and business context, so your team fixes the issues that genuinely matter first.
Continuously re-discover and re-assess as your environment changes, so new assets and exposures are caught within hours — not at your next quarterly scan.
Related
FAQ
Vulnerability management assesses a known list of assets. ASM first discovers what you have — including unknown and shadow assets — then continuously assesses them. ASM answers “what is exposed?” before “what is wrong with it?”
EASM is the part of ASM focused on internet-facing (external) assets — what an attacker can reach from outside your network.
No. ASM is performed externally from the attacker’s perspective, so there are no agents to deploy.
Continuously. The attack surface changes daily, so point-in-time scans quickly go stale.
Get the attacker’s view of your external footprint with Attack Insights.
