Before signing with an EASM vendor, ask how they discover assets, how they prove ownership, what they scan and how, who holds your data and how you can leave. Ask for evidence from a trial on your own estate. Good answers are specific. Vague answers are the warning.
EASM means external attack surface management: seeing your assets the way an attacker on the internet sees them. This list is vendor neutral and names no one. It is a set of questions, grouped so you can split them between security, legal and procurement.
Discovery
- What seeds do you need? Domains, company names, address ranges, cloud accounts? A vendor that needs only a company name should explain how it avoids false matches.
- How do you find assets we did not list? Ask for the methods, such as DNS records, certificates and cloud interfaces, and for an example from a customer of our size, anonymised.
- How often does discovery run? Daily, weekly or on demand. CISA's BOD 23-01 sets a 7 day cycle for federal agencies, which gives you a reference point, though it does not bind you.
- How do you handle removed assets? How long does a retired host stay in our list?
- What do you not see? Internal systems, application dependencies and anything behind login are normal answers. A vendor who says "everything" is not being honest.
Accuracy and ownership
- How do you decide an asset is ours? Ask for the evidence attached to each attribution.
- What is your false attribution rate, and how was it measured? If they have a number, ask for the method. If they have none, plan your own hand check of a sample.
- How do I correct a wrong attribution? And does the correction persist after the next run?
- Can I see why something was ranked high? The ranking should list its inputs, such as exposure, exploit evidence and asset role.
- Which public sources feed your risk view? CISA's Known Exploited Vulnerabilities catalog and FIRST's EPSS scores are open. Ask whether you can see them in findings.
Scope and safety
- What traffic do you send to our assets? Volume, type, source addresses.
- Can we pause or restrict scanning? By asset, time window or network.
- What do you do about third party assets that appear in our records? Rules for shared hosting and partner systems matter legally.
- Do you test for exploitability or only detect exposure? The two have different risks and different value.
Data
- Where is our data stored, and who can read it? Including staff of the vendor and subprocessors.
- Do you share or sell aggregated data? Get the answer in the contract, not a call.
- How do you protect the list of our weakest points? A list of your exposures is valuable to an attacker. Ask about their access controls and logging.
Contract and exit
- What drives the price, and what happens when we add assets? We are not quoting prices. Ask for the unit and for the rules on surprises, such as a large burst of newly found subdomains.
- Can we export all data and settings in a usable format? Test the export during the trial.
- What is the deletion process and timeline at exit? Get it written.
How do you use the answers?
Put the questions in a sheet, score each answer 0 to 3 and attach evidence. The trial then fills in the accuracy rows with real numbers instead of promises. Share the answers with legal early, because items 13, 15, 16 and 20 need contract language.
What about the code you ship?
An EASM tool sees what is exposed. It will not see a vulnerable library inside an application, or a build token with broad rights. Ask the vendor where its view stops, then cover the rest with a dependency inventory and a software supply chain process.
What to do
- Pick the ten questions that matter most to you and send them in writing before demos.
- Build an answer key list of known and suspected assets for the trial.
- Hand check 30 attributions during the trial.
- Have legal review the data, sharing and exit answers.
- Record answers in the sheet, and sign only against what is written down.
Safeguard focuses on the application and software supply chain side and does not replace an EASM service.
Quick check
Which question exposes weak vendors fastest?
Ask what they cannot see and how they decide an asset is yours. Strong vendors answer with specifics and limits. Weak ones answer with "everything" or a marketing phrase.
Should the contract mention scanning scope?
Yes. Define which assets may be scanned, what traffic is sent, and how to pause it, especially for shared or third party systems.
Sources
- CISA BOD 23-01
- NIST glossary: attack surface
- CISA Known Exploited Vulnerabilities catalog
- FIRST EPSS
Last reviewed: 18 October 2026.
