Quick answer: External attack surface management (EASM) is a security service that continuously discovers all of an organization's internet facing assets, that is its domains, subdomains, IP blocks, cloud resources and forgotten systems, and monitors the flaws on them. Most organizations do not know the whole of their own internet facing surface; the real risk is often in a forgotten subdomain or an old test server. EASM maps this surface before an attacker does. DSET runs this service with its local AI engine KAOS and verifies the flaws it finds with a working proof.

The first condition of defending an organization is knowing what will be defended. But the internet facing surface grows continuously: a new subdomain, a cloud bucket, a test environment. Attackers also look first here, at the assets the owner has forgotten. External attack surface management is a service that continuously discovers and monitors this surface. This article explains what EASM is, why it must be continuous and the DSET and KAOS approach.

What is external attack surface management

External attack surface management is a process that continuously discovers all of an organization's internet reachable assets, turns them into an inventory and monitors the flaws on them. Its difference from a one time scan is continuity and a discovery focus: the goal is not only to scan known systems but to find unknown ones. This discovery uses the same logic as passive information gathering, the first phase of a penetration test; for detail the passive reconnaissance and information gathering with OSINT source should be read.

Why it must be continuous

A penetration test gives a snapshot: it shows the flaws present on the test day. But the surface changes the next day. EASM closes this gap.

Approach What it covers Its limit
One time scan The known surface of the test day Misses new and forgotten assets
External attack surface management The whole open surface, continuously discovered Does not go into deep business logic
Continuous penetration testing (PTaaS) Discovery plus deep verification Limited by a defined scope

The essence of the table is: EASM continuously closes the breadth of the surface, while penetration testing proves the depth. Together they give the most complete defense and this is combined with the continuous penetration testing PTaaS model. For the difference of a scan from a penetration test the difference between vulnerability scanning and penetration testing is the reference point.

Which assets EASM finds

The assets an organization does not know are usually these: subdomains that have expired but still resolve, resources forgotten at a cloud provider, test servers left over from an old campaign and systems a supplier opened on the organization's behalf. The deep examination of forgotten resources on the cloud side falls within the scope of our cloud penetration testing service. The protection layer in front of web servers is evaluated together with the website security service and WAF.

The KAOS and DSET approach

DSET runs external attack surface management with its local AI engine KAOS. KAOS maps a broad external surface fast, detects newly appearing and forgotten assets and monitors the flaws on them. The difference is this: KAOS does not settle for saying a flaw is possible, it verifies every flaw it finds with a working proof and, with the principle of proof based verification, filters out false positive noise. This way your team prioritizes truly exploitable flaws, not scanner noise. This discovery also combines with our IoT and OT system penetration testing service when deep verification is needed.

Frequently asked questions

Does external attack surface management replace a penetration test? No, it complements it. EASM continuously discovers the breadth of the surface but does not exploit a defined scope in depth. A penetration test examines a narrow scope in depth and provably. In a mature program EASM finds new assets, the penetration test verifies the found assets in depth.

Does it also find shadow IT assets? Yes, this is the most important value of EASM. Shadow IT is systems a department or supplier opened without IT approval; they do not appear in the organization's official inventory but are internet facing. EASM surfaces these assets by discovering the organization's traces from the outside and adds them to the inventory.

How often should it run? As its name says it must be continuous; a one time discovery misses an asset that appears the next day. In practice discovery runs at regular and automatic intervals and produces an alert when a critical change is detected. DSET tunes this rhythm to the organization's surface size and rate of change.

Sources

To map the whole of your internet facing surface before an attacker and monitor flaws continuously, contact DSET. We provide external attack surface management and consulting from our Ankara Hacettepe Teknokent laboratory.