How EASM works

EASM looks at an organisation the way an attacker does: from the outside, with no credentials and no access to internal asset lists. It usually runs as a repeating cycle with four stages.

  1. Discovery. Starting from a few seeds such as a company name and primary domain, the platform finds related domains, subdomains, IP ranges, certificates, cloud resources and web applications using DNS records, certificate transparency logs, WHOIS data and internet-wide scanning.
  2. Inventory and attribution. Each asset is confirmed as belonging to the organisation (or a supplier acting for it) and recorded with what it runs and where it is hosted.
  3. Assessment. Assets are checked for open ports, exposed services, outdated software, known vulnerabilities, expired certificates and misconfigurations.
  4. Monitoring and prioritisation. The inventory is re-scanned on a schedule so new assets and new risks are flagged quickly, ranked by severity and business impact.

Why EASM matters

Most organisations do not have a complete record of what they expose to the internet. Marketing microsites, staging servers, acquired companies' domains and cloud services set up outside central IT all add to the external attack surface without appearing in the asset register. Attackers scan the whole internet continuously, so an exposure that nobody internally knows about is often found by someone else first.

For UK organisations there is also a regulatory angle. UK GDPR Article 32 expects appropriate technical measures to protect personal data, and Cyber Essentials assesses the internet-facing devices and services in scope. Both assume you know what you have. EASM provides the outside-in evidence that the inventory is complete.

EASM vs penetration testing vs CAASM

  • Penetration testing is a point-in-time, scoped exercise that tries to exploit known targets in depth. EASM is continuous and focuses on finding the targets in the first place, including ones that were never put in scope.
  • CAASM builds an asset inventory from the inside, by pulling data from internal tools through APIs. EASM builds it from the outside, which is why it finds assets those tools never knew about.
  • Digital risk protection watches for threats to the brand and people beyond your own infrastructure, such as impersonation and leaked data. Many teams use EASM and DRPS together.

Example

A retailer's EASM platform discovers promo-2023.example.co.uk, a campaign site built by an agency two years earlier. It still runs an unpatched WordPress plugin with a public exploit and collects email addresses through a form. Nobody in IT knew it existed. The finding is assigned to the marketing team, the site is taken offline and the subdomain is removed from DNS.

How DarkInvader helps

DarkInvader runs EASM continuously. Asset Discovery maps your internet-facing footprint from a company name and domain, Asset Monitoring re-checks it daily for changes, and Vulnerability Scanning tests what it finds. Findings are grouped, prioritised and explained so teams know what to fix first.

Explore Asset Discovery

Frequently asked questions

What is the difference between EASM and ASM?

Attack surface management (ASM) is the broad discipline of managing every route an attacker could use, internal and external. EASM is the subset that focuses on internet-facing assets and is carried out from the outside, the way an attacker would see them.

How often should EASM scans run?

Continuously, or at least daily for discovery and change detection. External assets change every time a team launches a site, opens a port or changes DNS, so an annual or quarterly view goes out of date quickly.

Does EASM replace penetration testing?

No. EASM tells you what is exposed and where the obvious weaknesses are, all year round. Penetration testing goes deep on a defined scope at a point in time. The two work best together, with EASM findings helping to scope better tests.

Related terms and reading

Sources