External Attack Surface Management (EASM): What It Is and Where Testing Fits

External attack surface management (EASM) is the continuous discovery, inventory and monitoring of everything your organisation exposes to the internet: domains, subdomains, IP addresses, web applications, remote access gateways, cloud services and certificates. Its main value is finding the assets nobody recorded, such as the staging site left running after a project ended or the cloud storage a supplier set up, because those are the systems that never get patched.

EASM answers the question “what do we have exposed?”. It does not, on its own, tell you whether an exposure can be exploited. That is the job of vulnerability scanning and penetration testing, which this guide covers further down.

What is attack surface management?

Attack surface management (ASM) is the ongoing process of discovering, inventorying, assessing and monitoring every point where an attacker could try to get into your systems. Your attack surface is the sum of those points. It has a digital side (internet-facing and internal systems), a human side (the people who can be phished) and a physical side (sites and devices). ASM focuses on the digital side.

The word that matters is continuous. Attack surfaces change every week: a developer starts a cloud instance, marketing launches a campaign site, a supplier changes a DNS record, a certificate expires. An inventory checked once a year is out of date within days. ASM treats discovery as a standing process, usually in six stages:

What is external attack surface management (EASM)?

External attack surface management is ASM from the outside in. It starts with a few “seeds”, such as your domain names, company and brand names and known IP ranges, and expands from them using the same public sources an attacker would:

• DNS records, to enumerate subdomains and the hosts they point to.
• Certificate transparency logs, which publicly record the TLS certificates that public certificate authorities issue for your domains, including ones for test and internal-sounding hostnames.
• Domain registration and IP allocation records, such as those held by RIPE NCC for UK and European address space, to find related domains and ranges.
• Internet-wide scan data, which shows open ports and the software answering on them.
• Public code repositories and paste sites, where hostnames, keys and passwords sometimes leak.

Attribution is the step that separates useful EASM from noise. A host on a shared cloud platform or content delivery network may mention your domain without being yours to test, so each asset has to be confirmed before anyone scans or tests it.

What are shadow IT and forgotten assets?

Shadow IT is technology used for work without the knowledge of IT or security: a SaaS tool someone signed up for with a work email, or a cloud account opened to test an idea. Forgotten assets are systems that were known once but dropped off the list. Both sit outside patching, monitoring and access control, which makes them easy targets.

How is ASM different from a vulnerability scan?

ASM finds out what exists and watches for change; vulnerability scanning checks known assets for known weaknesses in depth. A scanner only tests the targets it is given, so if a forgotten server is missing from the list, it is missing from every scan. ASM improves the list; scanning and testing examine what is on it.

Where do vulnerability scanning and penetration testing fit?

ASM gives you an accurate list of what is exposed; the next job is to find out which exposures are weak and which are dangerous. Regular vulnerability scanning services check every confirmed asset for known vulnerabilities and confirm fixes with rescans, and a vulnerability assessment adds the validation and prioritisation that turn results into a fix list. External penetration testing goes further: a tester maps your public footprint from DNS, certificate transparency and code repositories, often turning up hosts missing from your asset list, then proves by hand which exposures can be exploited. If you take card payments, the quarterly external scans under PCI DSS Requirement 11.3.2 must come from an Approved Scanning Vendor, and PCI ASV scanning is scoped from the IP addresses and domains you provide, which is another reason to know your full external footprint.

How do ASM, CAASM and CTEM relate?

These terms overlap, and vendors use them loosely:

Continuous threat exposure management (CTEM) is the framework that puts these pieces in order, with ASM feeding its discovery stage and testing providing validation. Between tests, breach and attack simulation tools replay known attack techniques to check that controls still block and detect them.

How do you start managing your external attack surface?

You can make real progress before buying any platform:

1. List your seeds. Every registered domain, brand, legal entity, IP range and cloud account, including those from acquisitions.
2. Pull what is already public. Review your DNS zones, search certificate transparency logs for your domains and check cloud provider inventories.
3. Give every asset an owner. Anything without an owner is a candidate for decommissioning; remove its DNS records when you do.
4. Register for NCSC Early Warning. It is a free NCSC service for UK organisations that sends alerts about suspected compromises, malicious activity, vulnerable services and open ports linked to the IP addresses and domains you register. It does not scan your networks itself and only covers what you register, so discovery still matters.
5. Scan what you find, then test what matters most. Put every confirmed asset into regular scanning and include the high-risk ones in your next penetration test.
6. Make discovery part of change management. New services should enter the inventory when they are built, not when someone finds them.

The NCSC’s asset management guidance sets out why an accurate inventory underpins every other security control.

How do you choose an EASM tool or service?

Choose by what you need it to achieve, then by how well it discovers and attributes your assets. The NCSC’s EASM buyer’s guide, published in September 2025, says EASM is worth considering for organisations responsible for several internet-accessible services, and frames the choice around seven questions rather than a feature list:

Attribution deserves the hardest look. A tool that lists hosts you do not own creates noise and, if someone scans them, legal risk; one that misses your supplier-hosted services leaves gaps. Before committing, run a trial against your own domains and compare what each product finds with the asset list you built in the steps above.

Whichever product you pick, it tells you what is exposed, not what can be broken. Confirmed assets still belong in your vulnerability scanning and the scope of your next external penetration test.

Do PCI DSS, ISO 27001 and Cyber Essentials require it?

None of them uses the term ASM, but each one requires the knowledge ASM produces:

A forgotten server can break all three at once: it is not in your inventory, it is not in your scan scope and it is not being patched.

Why Sovereign Secure

• External testing and scanning from one team. Our external penetration tests start with reconnaissance of your public footprint, and our vulnerability scanning covers internal and external systems with triage and rescans, so the assets your discovery turns up can be checked and tested.
• A PCI SSC Qualified Security Assessor company, with PCI ASV scans delivered through a PCI SSC Approved Scanning Vendor partner.
• An IASME-licensed Cyber Essentials certification body, issuing Cyber Essentials and Cyber Essentials Plus certificates, and ISO 27001 certified ourselves.

Next step

Send us your domains, known IP ranges and cloud providers, and tell us what prompted the question, and we will recommend whether an external penetration test, a scanning programme or both fits, with a fixed-price proposal. Use the penetration testing quote form or call +44 161 523 5276.