External attack surface management matures from a hand kept list of domains, to scheduled discovery, to owner routing, to risk based ranking, to validated and automated reduction. This five level model is ours, not a standard. Use it to see where you are and pick the next step.
What counts as progress?
CISA's Binding Operational Directive 23-01 starts from the claim that continuous and comprehensive asset visibility is a basic precondition for managing cyber risk. That sets the order for this model: see assets first, then judge them, then change them.
NIST defines an attack surface as the set of points on a boundary where an attacker can try to enter, cause an effect on, or extract data from a system. EASM is about the points visible from outside.
Level 1: A list
Someone keeps a spreadsheet of domains and public addresses. It is updated when someone remembers. Scans, if any, run against that list.
Typical gap: assets created by teams that never told the list owner.
Next step: pick two independent sources, such as DNS registrar records and cloud account inventories, and compare them to the list.
Level 2: Scheduled discovery
Discovery runs on a schedule from known seeds and finds assets beyond the list. The directive above uses 7 days as the cycle for federal agencies, a handy reference point for your own cadence.
Measure: assets found that were not on the list, and the proportion that were yours.
Typical gap: findings sit in a console with no owner.
Level 3: Owners and routes
Every asset has an owner or a flagged "unowned" status. Findings become tickets for the owner. Unowned assets go to a short review queue, where the rule is: claim it, or retire it.
Measure: share of assets with an owner, median age of unowned assets, and tickets created per week that reached a human.
Typical gap: everything is treated equally.
Level 4: Ranked by risk
Findings are ranked by exposure, exploit evidence and asset importance. Open sources help: CISA's Known Exploited Vulnerabilities catalog lists flaws with evidence of exploitation, and FIRST's EPSS gives a daily probability of exploitation in the next 30 days. Your own asset importance rating is the part no outside source supplies.
Measure: age of the oldest exploited vulnerability on exposed systems, and the share of high ranked findings fixed within target.
Typical gap: ranking is done but never checked against reality.
Level 5: Validated and reducing
The team validates the top findings, confirms they are reachable and exploitable with the access an outsider has, and removes exposure at the source: closing ports, retiring services, tightening configuration. Some low risk fixes are automated, with approval for the rest. The attack surface itself shrinks over time, not just the ticket count.
Measure: number of exposed services over time, share of top findings validated, and time to remove confirmed exposure.
Which level do you need?
Not every company needs level 5. A small company with one cloud account may do well at level 3. A company that acquires others, or lets teams create resources freely, will gain from levels 4 and 5 sooner. Match the level to the rate at which your estate changes.
One caution applies at every level: a higher level is not a goal in itself. Teams sometimes buy level 5 tooling while level 3 basics, like owners and a retirement rule, are missing. The tools then produce a long, accurate list that nobody acts on.
Where does the software you ship fit?
EASM tools see what is reachable. They do not see inside your applications. A fully mature EASM program can still miss a vulnerable library behind a login page. Pair EASM with a dependency inventory and reachability analysis, and let the two feed one risk ranking.
What to do
- Place yourself on the five levels, honestly, with evidence.
- Compare your asset list to two independent sources.
- Set a discovery cadence and write it down.
- Assign owners, and create an unowned queue with a deadline.
- Add exposure and exploit evidence to your ranking.
- Validate the top ten findings every cycle before fixing the rest.
- Add application dependencies to the same ranking.
Safeguard focuses on the application and software supply chain side. It offers asset discovery with guardrails on discovered assets, and it does not replace an external attack surface tool.
Quick check
Do all companies need level 5?
No. Match the level to how fast your estate changes. A small, stable estate may be well served by level 3, with owners and scheduled discovery.
What is the first step up from a spreadsheet?
Compare the spreadsheet with two independent sources, such as registrar records and cloud accounts. The gap shows what discovery would find.
Sources
- CISA BOD 23-01
- NIST glossary: attack surface
- CISA Known Exploited Vulnerabilities catalog
- FIRST EPSS
Last reviewed: 18 October 2026.
