Attack surface management has a vocabulary problem: vendors use the same words for different things. This glossary gives plain meanings for fifteen terms, with a test for telling similar ones apart. Where an official definition exists we quote its source. Where it does not, we say the term is used loosely.
The core terms
Attack surface. NIST defines it as the set of points on the boundary of a system, a system element or an environment where an attacker can try to enter, cause an effect on, or extract data from it. It is about reachable points, not about flaws.
Asset. Anything you own or run that matters: a server, a domain, a code repository, a cloud account, a SaaS tenant, a service account. The list is only as good as its sources.
Exposure. An asset or weakness that can be reached from where an attacker stands. A database is an asset. A database reachable from the internet is an exposure.
Vulnerability. A specific flaw, usually with an identifier, in software or configuration. A vulnerability on an unreachable system is a defect. On a reachable system it is a risk.
Misconfiguration. A setting that is wrong rather than a code flaw, such as a storage bucket left open. It has no patch, only a correction.
Terms about finding things
Asset discovery. Finding assets you did not list. CISA's Binding Operational Directive 23-01 describes it as identifying what network addressable assets reside on a network and their IP addresses, noting it is non intrusive and usually needs no special access.
Vulnerability enumeration. Listing suspected flaws on assets already found. The same directive separates it from discovery. Discovery asks what exists. Enumeration asks what is wrong with it.
Shadow IT. Systems and services used without the central team's knowledge. Often it is a team solving a problem quickly, not bad faith.
Orphaned asset. Something running that nobody owns, such as an old campaign site. The risk is that nobody patches or retires it.
Terms vendors blur
EASM, external attack surface management. Looks at your assets from outside, the way an attacker would, starting from your domains, names and addresses. It finds what is visible from the internet.
CAASM, cyber asset attack surface management. The term is used loosely, and we could not confirm a standards body definition. In common use it means pulling asset data from systems you already run into one inventory. The difference from EASM is the viewpoint: inside out versus outside in.
ASM, attack surface management. Umbrella label for the whole practice: discover, classify, prioritise, reduce. Some tools do part of it and still use the label.
CTEM, continuous threat exposure management. A program idea, not a tool, that cycles through scoping, discovery, prioritisation, validation and mobilisation. It uses ASM as an input.
Two terms to keep apart
Attack surface reduction. Making the surface smaller: closing ports, removing unused services, deleting old accounts. Management finds. Reduction acts.
Software supply chain exposure. The part of your surface that arrives as other people's code: dependencies, build tools, container images. An external scan will not see it, because it is inside the application.
A quick way to tell them apart
Ask three questions of any term.
- Is it a thing (asset, exposure, flaw) or an activity (discovery, enumeration, reduction)?
- Does it look from outside or from inside?
- Does it assume you already know the asset exists?
Most confusion in sales calls comes from skipping question three. A scanner that assumes the asset is known cannot help with orphaned assets.
Why does the wording matter for buying?
Procurement documents, board slides and audit answers all reuse these words. If the security team says "attack surface management" and finance hears "vulnerability scanning", the budget request will be judged against the wrong benchmark. Settle the vocabulary first, and the comparison of tools gets much easier because each claim can be checked against a definition.
What to do
- Pick the definitions you will use internally and publish them on one page.
- Ask vendors to restate their claims in your terms. "We find unknown assets" is a discovery claim and needs evidence.
- Separate three lists: assets you know, assets discovered, assets you act on.
- Track orphaned assets as their own number.
- Keep application dependencies in their own inventory and link it to the asset list.
Safeguard focuses on the application and software supply chain side. It includes asset discovery with guardrails on discovered assets, and does not replace an external attack surface tool.
Quick check
What is the simplest difference between asset discovery and vulnerability enumeration?
Discovery finds what exists. Enumeration lists the suspected flaws on what was found. Discovery comes first, because you cannot assess assets you do not know about.
Is CAASM the same as EASM?
No. EASM looks from outside at what is visible on the internet. CAASM, as the term is commonly used, consolidates inside data from tools you already run.
Sources
Last reviewed: 18 October 2026.
