External Attack Surface Management (EASM)

Overview

External Attack Surface Management (EASM) is the continuous discovery and risk management of internet-visible assets, services, domains, cloud resources, certificates, and exposures associated with an organization. The control exists to reduce the likelihood and impact of compromise by making assets, identities, software, data, exposures, and control responsibilities visible and governable. It is a subset or external perspective of broader attack surface management and should include unknown and third-party-hosted assets, not only registered corporate systems. It should be interpreted alongside Attack Surface Management (ASM) because the concepts can affect the same decision without representing the same control, event, or risk.

The workflow identifies the protected object and owner, evaluates threats and dependencies, applies preventive and detective safeguards, and routes exceptions or failures to accountable teams. Controls should be tested against realistic misuse, version changes, privileged access, third parties, and recovery conditions. In this context, a mature process validates attribution, removes false positives, assigns ownership, combines exposure with exploitability and business impact, tracks remediation, monitors new assets and changes, and confirms that closed findings are no longer externally reachable.

It should connect the term to Cloud Security Posture Management (CSPM) where that relationship changes access, transaction treatment, investigation, communication, or recovery.

Records should preserve scope, ownership, configuration or policy version, changes, approvals, test results, alerts, exceptions, incidents, remediation, and verification that the risk was reduced. Evidence must be protected from alteration and retained according to legal and operational need.

Useful measures include coverage, control effectiveness, unresolved critical findings, remediation age, unauthorized changes, detection time, incident frequency, repeat weaknesses, exception volume, and recovery performance.

The relationship with API Inventory should be documented where it affects residual risk or control ownership.