The attack surface, in one sentence
Your external attack surface is every system an outsider can reach: websites, mail servers, VPN gateways, remote access, APIs, cloud services and the forgotten test server from three years ago. Each one runs software, and software has weaknesses.
Attackers begin by mapping what answers on the internet under your name, then look for the easiest door. Attack surface management (ASM) means doing that mapping first, and doing it continuously.
Why the list you have is never complete
Most organisations keep an inventory, and most inventories are out of date the week after they are written. Typical gaps:
- Shadow IT. A team signs up for a service or sets up a server without telling IT.
- Leftovers. A campaign site, a staging system or an old mail gateway that nobody switched off.
- Suppliers. An agency or provider runs a system under one of your names.
- Change. A firewall rule opened for a weekend, and never closed.
You cannot protect what you do not know about. That is why discovery comes first.
How attack surface management works
- Discover. Start from your domain names and collect everything linked to them from public sources: certificate transparency logs, DNS, the registries of network blocks and internet-wide scan data.
- Identify. For each address, find out what answers on which port, which software it runs and, where it can be read, which version.
- Prioritise. Match what was found against known vulnerabilities, the list of vulnerabilities known to be exploited in the wild (KEV) and the likelihood of exploitation (EPSS). Exposed remote access and databases count as well, even without a known vulnerability.
- Monitor. Repeat it every day, because the surface changes every day, and raise an alert when something critical appears.
ASM, EASM, scanners and penetration tests
EASM (external attack surface management) is the outside view only: what anyone on the internet can see. ASM is the wider term and can include internal networks as well.
A vulnerability scanner checks the list of systems you give it. ASM first finds what belongs on that list. The two complement each other.
A penetration test is a deep, manual test of a defined scope at one point in time. ASM is broad and continuous. A yearly test tells you how strong the doors were on one day; ASM tells you when a new door appears.
Where to start
- List the domain names your organisation owns, including old and parked ones.
- Find what is linked to them and confirm what is really yours.
- Close or protect anything exposed that should not be: remote desktop, file sharing, databases and admin interfaces come first.
- Patch what matches known-exploited vulnerabilities.
- Keep watching, and decide who gets told when something changes.