EASM in the first 90 days for a small team, a phased plan

With one or two people, start external attack surface management by building a seed list of domains and accounts, running discovery, assigning an owner to every finding, and deleting what nobody uses. By day 90 you should have a weekly routine and a short list of recurring causes to fix.

Days 1 to 10: Seed and scope

List what you know: primary domains and brand names, cloud accounts, hosting providers, mail services, and any acquired companies. Check your DNS registrar and DNS zones for domains you forgot you hold. Ask finance for cloud and hosting invoices, since unknown vendors show up there.

Write the scope rule: you only probe things you own or are authorized to test. Record that in the plan, because discovery tools can touch third party systems if you point them badly.

Choose the first tool or method. A commercial service, an open source discovery tool, or scripts plus certificate transparency searches all work for a first pass. Decide by your budget and time, not by features.

Days 11 to 25: First discovery and triage

Run the first pass. Expect a large, messy list. Sort findings into four buckets: known and correct, known but unmanaged, unknown but ours, and unknown and not ours.

Triage by exposure. A login page or admin panel on the internet matters more than a marketing page. Old environments, test sites and storage endpoints deserve early attention, since they often hold real data.

For each item, find an owner. Use DNS change history, cloud tags, repository mentions and asking in chat. Items with no owner after two weeks go to a leader with a deadline: claim it or remove it.

Days 26 to 45: Remove and reduce

Deletion is the highest value action in the first 90 days. Remove DNS records pointing at nothing. Shut down unused test sites. Close ports that need not be open. Retire accounts for departed contractors. Each removal shrinks what you must watch.

For things you keep, fix the basics: current software, strong authentication on every login page, no debug output, and a certificate that renews automatically.

Containment before deletion: if an exposed asset might hold sensitive data, block access and keep a copy for log review before you delete it. NIST SP 800-61 Rev. 3 is a good outline if the review finds signs of access.

Days 46 to 65: Build the routine

Set a weekly rhythm. CISA's BOD 23-01 gives a public benchmark for federal agencies of automated discovery every 7 days and vulnerability enumeration started every 14 days. A small company can use the same cadence as a target.

Define what happens to a new finding: who sees it, who must respond within what time, and where it is recorded. Keep a simple register with asset, owner, exposure, status and date.

Add owner and review dates to DNS records and cloud projects, so new items do not arrive unowned.

Days 66 to 80: Rank by real risk

Add context to severity. Use CISA's Known Exploited Vulnerabilities catalog to see whether a flaw on a found service has been exploited in the wild. FIRST's EPSS estimates the probability of exploitation in the next 30 days. Combine with exposure and the data held.

Days 81 to 90: Measure and plan

Report five numbers: assets found, assets with owners, items removed, median days from discovery to owner, and repeat causes. Choose the top two causes, such as contractor DNS records or untagged cloud projects, and make one process change for each. Decide what to keep, buy or drop.

What about application exposure?

External discovery finds the front door, not the code behind it. Safeguard focuses on the application and software supply chain side, including asset discovery with guardrails and reachability analysis, and does not replace an EASM tool.

What if discovery finds too much?

Do not try to fix everything. Cap the work: take the ten findings with the most exposure and the most sensitive data, and finish those before looking at the rest. Record the remainder in the register with a review date. Large first scans are normal, since most companies have years of accumulated records. Progress shows in how fast the number of unowned items falls, not in a zero count on day one. Share that trend with leadership, so the early large number reads as a baseline rather than a failure.

What to do

1. Build the seed list and scope rule in week one.
2. Run discovery and sort findings into four buckets.
3. Assign owners and set a claim or remove deadline.
4. Delete unused assets first.
5. Run weekly discovery with a simple register.
6. Report five numbers at day 90 and fix the top two causes.

Quick check

Sources

1. CISA BOD 23-01
2. CISA Known Exploited Vulnerabilities Catalog
3. FIRST, Exploit Prediction Scoring System
4. NIST SP 800-61 Rev. 3

Last reviewed: 18 October 2026.