How CAASM works

CAASM platforms connect to the tools an organisation already runs, for example endpoint protection, mobile device management, cloud provider APIs, identity directories and configuration management databases. They de-duplicate and correlate the records into one view of each asset, then run queries against it. Typical questions are which laptops have no endpoint agent, which cloud instances are missing from the CMDB, or which accounts have no multi-factor authentication.

CAASM vs EASM

  • Viewpoint. CAASM looks from the inside using data the organisation already holds. EASM looks from the outside, as an attacker would.
  • Blind spots. CAASM can only see assets that at least one internal tool knows about. EASM finds assets that no internal tool knows about, such as shadow IT, agency-built sites and acquired domains.
  • Typical output. CAASM highlights control gaps across known assets. EASM highlights unknown exposure and internet-facing risk.

The two are complementary. Feeding EASM discoveries into a CAASM inventory gives the most complete picture.

Example

A CAASM query shows 40 cloud virtual machines that exist in the AWS account but have no vulnerability scanner coverage. Separately, an EASM scan finds a web server hosted with a small provider that does not appear in any internal system. The first is a coverage gap on known assets. The second is an unknown asset that CAASM could never have found.

How DarkInvader helps

DarkInvader provides the outside-in half of the picture. It discovers internet-facing assets that internal tools miss and can export them through the Client-Facing API or integrations so they can be added to your internal inventory.

Explore Asset Discovery

Frequently asked questions

Is CAASM better than EASM?

Neither is better. They answer different questions. CAASM consolidates what you already know about. EASM finds what you do not know about. Most mature programmes use both.

Does CAASM find shadow IT?

Only partly. CAASM finds shadow IT that appears in at least one connected tool, for example a cloud account. Assets that no internal system records, such as a site built by an agency on its own hosting, are usually only found from the outside.

Who coined the term CAASM?

Gartner introduced the term in 2021 alongside EASM and digital risk protection, as part of its description of the attack surface management market.

Related terms and reading

Sources