External attack surface management, or EASM, is the practice of continuously discovering the internet-facing assets that belong to you, such as domains, hosts, services and apps, and checking them for exposure. It works from the outside, with no agents installed. Its main value is finding things you forgot you had.
How is it different from a vulnerability scan?
A traditional scan starts with a list you give it. EASM starts with your name, domains or known address ranges and looks for the rest. That difference matters, because the dangerous asset is usually the one nobody put on the list: a staging site, an old marketing page, a test database left reachable.
CISA's free Cyber Hygiene services show the idea in a government context. The vulnerability scanning service continuously assesses internet-accessible assets, using public static IPv4 addresses, and sends weekly reports plus ad-hoc alerts on urgent findings such as risky services and known exploited vulnerabilities. A separate web application scanning service examines public web apps, including issues listed in the OWASP Top Ten. CISA says its services look for assets exposed to the internet, which is the EASM premise in plain words.
What does EASM typically do?
Vendors differ, so treat this as a general outline rather than a definition everyone shares:
- Discovery: build an inventory of domains, subdomains, IP addresses, certificates and exposed services linked to your organization.
- Attribution: decide which found assets are really yours. This step produces false matches, so check it.
- Assessment: look for open ports, outdated software, weak configuration and exposed admin panels.
- Prioritization: rank by exposure and likelihood of exploitation.
- Handoff: send findings to the owner with enough detail to fix them.
What does it miss?
It sees what the internet sees. It will not tell you about internal misconfiguration, a compromised laptop, or a flaw inside an authenticated part of an app. It also cannot see your private repositories or your build pipeline. A package you ship with a vulnerable dependency looks fine from outside until someone exploits it.
Discovery can also overreach. Shared hosting or a similar company name can pull in assets that are not yours.
A constructed example
A company runs its main app on a well-managed platform. A developer left a demo environment up after a conference, behind a forgotten subdomain. EASM-style discovery finds the subdomain through certificate records, flags an old admin login page and sends it to the team that owns that sub-brand. The team shuts it down. This is a made-up case, but it matches the typical value: inventory, not cleverness.
How should you judge a tool or service?
Ask how it discovers assets and how often. Ask how it handles false attribution. Ask whether findings carry an owner and a fix, or just a score. Ask how it ingests your known assets and cloud accounts so you do not rediscover what you already track. And ask what it does not cover, since honest answers are a good sign.
Is EASM a fit for software teams?
Yes, as one layer. It watches the outside edge. Your application and supply chain risks live earlier, in code, dependencies and pipelines. Safeguard focuses on that application and software supply chain side and does not replace an EASM tool. A sensible program uses both and routes findings to the same owners.
What to do
- Write down the domains, brands and cloud accounts you know you own.
- Run an external discovery, with a tool or a service, and compare to your list.
- Assign an owner to every unknown asset or retire it.
- Fix the exposed items that are known to be exploited first.
- Repeat on a schedule, since the surface changes with every deploy.
- Feed new assets into your regular scanning.
Quick check
Does EASM replace penetration testing?
No. EASM maps and monitors exposure continuously. A penetration test tries to exploit chosen systems in depth, including parts behind login.
Can we do this without buying anything?
You can start with your own domain and certificate records and with no-cost government services where you qualify, such as CISA's. Eligibility rules apply.
Sources
Last reviewed: 18 October 2026.
