A two week external attack surface management (EASM) trial is useful only if you define success first. Seed the tool with domains you own, compare what it finds against what you already know, and judge it on accuracy, ownership and fix speed rather than the size of the asset count.
What is an EASM tool supposed to do?
EASM discovers internet facing assets that belong to your organization: domains, subdomains, IP ranges, certificates, cloud hosted services and exposed login pages. It looks at your company from the outside, the way a stranger would. The hard part is attribution, deciding that a given host is really yours.
Before day one
Spend a few hours on preparation, because the trial is short.
Write down your ground truth. Collect the root domains, known IP ranges, cloud accounts and the handful of shadow assets you already suspect exist, such as an old marketing microsite. Choose five of those as "plants" the tool should find. Decide who will triage findings, and book thirty minutes a day for them.
Agree on pass criteria in writing. For example: finds at least four of five plants, wrong attribution under a share you can tolerate, and every high severity finding has an owner within a day.
Days 1 to 3: seed and watch
Give the tool only root domains and let it discover. Do not hand it your full asset list, or you cannot tell what it found from what you told it. Record what appears in the first day, then again on day three. Note how it explains each asset: what evidence links this host to you.
Tag every finding in a simple sheet with four labels: yours and known, yours and unknown, not yours, and unclear. The second label is the value. The third is the cost.
Days 4 to 7: check precision
Pick twenty findings at random and verify them by hand. Is the host really yours? Is the exposure real or a false alarm from a banner? Count the misses honestly. A tool that reports hundreds of assets with a high wrong share will cost your team more than it saves.
Test change detection. Ask a colleague to add a harmless test subdomain or open a test port in a sandbox account, then measure how long the tool takes to notice. Ask whether it tells you what changed or only that something did.
Days 8 to 11: test the workflow
Discovery is half the job. Walk three findings from alert to fix. Who is told? Does the ticket carry enough detail for the owner to act? Can you suppress a known accepted risk without hiding it forever? Does the tool export to the systems you use?
Look at the evidence trail too. An auditor or customer may ask how you know your external footprint. A dated history of what was seen and what was done about it answers that.
Days 12 to 14: decide
Score against the written criteria. Add three items teams forget: how much analyst time the trial took, what the vendor needed from you to work (credentials, DNS access, cloud roles), and what happens to your data if you leave.
If the tool found real unknown assets with good attribution, that is a pass worth paying for. If it mainly restated what you knew, a cheaper approach such as scripted certificate and DNS monitoring may be enough.
What a trial cannot tell you
Two weeks will not show long term noise, how the vendor handles support, or how the tool copes with acquisitions. Ask for references on those, and ask what changed in their product in the last year.
Where Safeguard fits
EASM is not a Safeguard product. We focus on the application and software supply chain side, and we do not replace an EASM tool. The two meet when an exposed service turns out to run a vulnerable dependency, which is where dependency and reachability data helps you decide what to fix first.
What to do
- Write ground truth and five planted assets before the trial.
- Set pass and fail criteria in writing.
- Seed with root domains only and label every finding.
- Hand verify twenty random findings for precision.
- Test change detection with a harmless sandbox change.
- Walk three findings from alert to fix.
- Record analyst hours and data exit terms, then decide.
Quick check
How many assets should an EASM tool find in two weeks?
There is no good number. Judge it by how many real, previously unknown assets it finds and how accurately it attributes them to you.
Should I give the tool my full asset inventory?
Not at first. Seed it with root domains so you can see what it discovers on its own, then import your inventory later for comparison.
Sources
- NIST SP 800-137, Information Security Continuous Monitoring: visibility into organizational assets as the base of monitoring.
- MITRE ATT&CK FAQ: adversary tactics and techniques as a shared language for what attackers do.
The trial structure is practical guidance, not a standard.
Last reviewed: 18 October 2026.
