EASM, ASM, CAASM, CSPM and CTEM, a glossary of mixed up terms

EASM looks at your company from the outside, the way an attacker would. ASM is the broader job of knowing and reducing everything exposed. CAASM pulls inventory from your own tools. CSPM checks cloud settings. CTEM is a program wrapped around all of them. Each answers a different question.

Attack surface

The sum of the places where an unauthorized party could try to get in or get data out: public services, accounts, code, dependencies, people, suppliers. It is bigger than "internet facing hosts."

Question: where could someone try to get in?

ASM (attack surface management)

The ongoing practice of discovering, inventorying, assessing and reducing the attack surface. It includes people and process, not only tools. A tool may help, but a spreadsheet with owners and a weekly review is also ASM.

Question: do we know what we expose and are we shrinking it?

EASM (external attack surface management)

The external view: finding assets reachable from the internet using public data such as DNS, certificates and open ports, with no agents installed. Its strength is discovering things you forgot you had. Its limit is that it cannot see inside accounts, devices or code.

Question: what does the internet see of us?

CAASM (cyber asset attack surface management)

The internal view: connecting to your existing tools, such as cloud accounts, endpoint agents, identity systems and ticketing, to build one inventory of assets and gaps. Its strength is an owner and context for each asset. Its limit is that it only knows what your tools know, so it will miss the forgotten host.

Question: what do we own, and who is responsible for it?

CSPM (cloud security posture management)

Checks cloud account configuration against good practice: open storage, over broad roles, missing logging. It sees inside cloud accounts, not outside them and not your code.

Question: are our cloud settings safe?

SSPM (SaaS security posture management)

The same idea for SaaS applications: settings, admin accounts and connected apps in tools like mail and file sharing.

Question: are our SaaS settings and access safe?

DRP (digital risk protection)

Watches outside sources for brand abuse, leaked credentials and lookalike domains. It looks at what is said and posted about you, which differs from your own assets.

Question: who is impersonating or exposing us elsewhere?

Vulnerability management

Finds and fixes known flaws in software and systems you run. It starts from an asset list and a scanner. CISA's BOD 23-01 pairs the two for federal agencies: automated asset discovery every 7 days and vulnerability enumeration started every 14 days.

Question: which known flaws do we have, and which first?

CTEM (continuous threat exposure management)

A program name from industry analysts for a repeating cycle: scope, discover, prioritize, validate, mobilize. It is a way to organize the others, not a separate scanner. NIST SP 800-137 on continuous monitoring covers a similar goal of ongoing visibility into assets, threats and control effectiveness.

Question: are we running a loop that reduces real exposure?

Shadow IT and orphaned assets

Shadow IT is technology used without approval. An orphaned asset is something still running with no owner, often left from a migration or a project. EASM tends to find orphans, and CAASM tends to expose missing owners.

Which one do you need?

A short guide. If you suspect forgotten internet facing things, start with external discovery. If you cannot say who owns what, start with an inventory that joins your tools. If your risk is in cloud accounts, check posture there. If you write software, add dependency and code scanning, which none of the terms above cover.

Where Safeguard fits

Safeguard focuses on the application and software supply chain side. It offers asset discovery with guardrails on discovered assets and reachability analysis for dependencies, and it does not replace EASM, CAASM, CSPM or DRP tools.

Why do vendors blur these terms?

Because categories merge as products grow. An external discovery tool adds an internal connector and calls itself CAASM. A posture tool adds domain discovery and calls itself EASM. The label on the box tells you little, so ask for a test: give the vendor your own list of twenty known assets and five forgotten ones, then see which it finds and what context it attaches. The test shows the real scope in an afternoon, and it works the same way for every term in this glossary.

What to do

1. Write which question you most need answered today.
2. Match it to the term above and shortlist that category only.
3. Ask vendors which of the questions their product cannot answer.
4. Keep one owner field across all inventories.
5. Do not buy a program name. Build the cycle first.
6. Revisit the glossary when a new acronym arrives.

Quick check

Sources

1. CISA BOD 23-01
2. NIST SP 800-137

Last reviewed: 18 October 2026.