What Is Attack Surface Management? How ASM Works And When You Need It

Attack surface management (ASM) is the ongoing process of finding every internet-facing and internal asset an organization owns, working out which of them are exposed or misconfigured, and tracking that exposure as it changes. It answers a question most security teams cannot answer from memory: what do we actually have, and what can an attacker see? ASM does not replace vulnerability scanning or penetration testing. It feeds them, by telling you what to scan and what to put in scope.

This guide explains how attack surface management works, the difference between external attack surface management (EASM), cyber asset attack surface management (CAASM) and continuous threat exposure management (CTEM), and where ASM fits next to vulnerability scanning and pentesting. If you are already comparing products, see our list of top attack surface management platforms.

What Counts As An Attack Surface?

Your attack surface is every point where an attacker could try to get in or pull data out. For most organizations it includes:

• Domains and subdomains, including old marketing microsites and staging environments nobody remembers launching.
• IP ranges and hosts, both in your own data centers and at cloud providers.
• Exposed services, such as remote access gateways, VPN portals, admin panels, databases and file transfer servers.
• Web applications and APIs, including third-party hosted apps that carry your brand.
• Cloud resources, such as storage buckets, serverless functions and managed databases spun up outside central IT.
• TLS certificates, DNS records and code repositories that reveal infrastructure or leak secrets.
• Internal assets, such as endpoints, servers, user accounts and SaaS tenants, which matter once an attacker is inside.

The hard part is that this inventory changes every week. Acquisitions bring in unfamiliar domains, developers create cloud accounts on a credit card, and vendors host services under your name. ASM exists because a spreadsheet maintained by hand falls out of date almost immediately.

How Attack Surface Management Works

Most ASM programs and platforms follow the same loop: discover, inventory, assess, prioritize and remediate, then repeat continuously.

1. Discovery

External discovery usually starts from a small set of known facts, often called seeds: a primary domain, a company name, known IP blocks or an autonomous system number. The platform then expands outward. Microsoft’s documentation for Defender External Attack Surface Management describes this well: it finds infrastructure with strong connections to your discovery seeds, then recurses from each new finding to uncover more, including properties you did not know existed.

Common discovery techniques include:

• Passive DNS records, WHOIS and registrant data, and reverse DNS lookups.
• Certificate transparency logs, which publish every publicly trusted TLS certificate and often reveal subdomains.
• Internet-wide port scan data and service banners.
• Cloud provider APIs and connectors for accounts you already know about.
• Code repositories, paste sites and other public sources where hostnames or credentials leak.

Internal discovery works differently. Instead of probing from the outside, CAASM tools pull asset records from the systems you already run, such as endpoint management, EDR, identity providers, cloud consoles, CMDBs and vulnerability scanners, through API integrations.

2. Inventory And Attribution

Raw discovery produces noise. A key job of ASM is attribution: confirming that a domain or IP actually belongs to you, a subsidiary or a vendor acting for you, and not to an unrelated company with a similar name. Good platforms show why they linked an asset to you so analysts can confirm or reject it. The result is an inventory with owners, business units and context such as whether an asset is production or test.

3. Exposure Assessment

Once an asset is attributed, the platform checks what it exposes: open ports, software versions, expired or weak certificates, login pages, default credentials, missing security headers, known vulnerable components and misconfigured cloud storage. Many tools run light, non-intrusive checks here. Deep exploitation is usually left to a separate validation step or a human tester.

4. Prioritization

Not every exposed asset is urgent. ASM tools rank findings by factors such as whether the asset is internet-facing, whether a public exploit exists, how critical the business service is and whether the issue is already being exploited in the wild. Prioritization is where products differ most, so ask vendors to explain their scoring.

5. Remediation And Monitoring

Findings are routed to owners through ticketing integrations, then rechecked automatically. Because new assets keep appearing, discovery runs continuously or on a frequent schedule. Alerts on newly discovered assets are often more valuable than the vulnerability findings themselves.

EASM vs CAASM vs CTEM

The ASM market uses several overlapping acronyms. Here is how they relate.

External Attack Surface Management (EASM)

EASM looks at your organization from the outside, the way an attacker would, with no credentials and no agents. It is best at finding unknown internet-facing assets: forgotten subdomains, shadow IT, exposed admin panels and cloud resources created outside central control. When people say “attack surface management” without a qualifier, they usually mean EASM.

Cyber Asset Attack Surface Management (CAASM)

CAASM looks inward. It aggregates asset data from the security and IT tools you already own into one queryable inventory, then highlights gaps, such as servers with no EDR agent, devices missing from the vulnerability scanner or accounts without MFA. CrowdStrike’s explainer on CAASM notes that it covers both internal and external assets and lists API integrations with cloud platforms and endpoint management systems as a core discovery method. Axonius, which describes itself as an asset intelligence platform, is a well-known example of this approach.

Continuous Threat Exposure Management (CTEM)

CTEM is not a product category. It is a program framework introduced by Gartner in 2022 with five stages: scoping, discovery, prioritization, validation and mobilization. ASM tools cover the discovery stage and part of prioritization. The validation stage asks whether an exposure can really be exploited, which is where penetration testing, automated pentesting and breach and attack simulation come in. Mobilization is the people and process work of getting fixes done.

Factor	EASM	CAASM	CTEM
What it is	Tool category	Tool category	Program framework
Viewpoint	Outside in, unauthenticated	Inside out, via existing tools	Whole program, all exposures
Main data source	DNS, certificates, internet scans, public sources	APIs of EDR, IAM, cloud, CMDB and scanners	Combines ASM, scanning, testing and threat intel
Best at finding	Unknown internet-facing assets and shadow IT	Coverage gaps and inventory conflicts	Which exposures matter and get fixed
Blind spots	Internal assets, business logic flaws	Assets no tool knows about	Depends on the tools and people behind it

ASM vs Vulnerability Scanning vs Penetration Testing

These three activities are often confused because vendors increasingly bundle them. They answer different questions.

• Attack surface management asks: what do we have, and what is exposed? It is continuous and broad, but mostly shallow.
• Vulnerability scanning asks: which known weaknesses exist on the assets we point it at? It needs a target list, which is exactly what ASM supplies. Our guide to vulnerability scanning vs penetration testing covers this boundary in detail.
• Penetration testing asks: can someone actually break in, and how far can they get? A human tester chains issues together, tests business logic and proves impact. It is deep but happens at a point in time against a defined scope.

Factor	Attack Surface Management	Vulnerability Scanning	Penetration Testing
Core question	What do we have and what is exposed?	Which known flaws exist?	Can an attacker exploit them?
Needs a target list	No, it builds one	Yes	Yes, a defined scope
Frequency	Continuous	Scheduled, often weekly to quarterly	Periodic, often annual plus after major change
Depth	Shallow, non-intrusive	Medium, signature based	Deep, manual exploitation and chaining
Finds unknown assets	Yes, its main purpose	Rarely	Sometimes, during reconnaissance
Satisfies pentest requirements	No	No	Yes, when scoped correctly

In practice the three work as a chain. ASM finds the assets, scanning checks them for known issues on a schedule, and penetration testing proves which issues lead to real compromise. ASM output also makes pentests better: a tester given a current external inventory spends less time on reconnaissance and more on exploitation. If you buy external testing, our list of top external penetration testing companies is a good starting point.

[EXPERT QUOTE: White Knight Labs, John Stigerwalt, on the forgotten external assets attackers find first and why an ASM inventory does not prove those assets are safe]

Where Automated Validation Fits

Between ASM and a human pentest sits a growing set of tools that try to validate exposures automatically. Automated penetration testing products such as Horizon3.ai’s NodeZero, which the company describes as running real attack techniques without agents, can test whether an exposed service leads somewhere useful for an attacker. Breach and attack simulation (BAS) tools test whether your controls detect and block known techniques. Both map to the validation stage of CTEM. For more, see our lists of automated penetration testing platforms and breach and attack simulation platforms.

When You Need Attack Surface Management

Not every organization needs a dedicated ASM platform. These are the situations where it usually pays off.

You Have Grown Through Acquisitions

Every acquisition brings domains, cloud accounts and legacy systems that your team did not build. EASM is one of the fastest ways to find what came with a deal and what was never decommissioned.

Teams Can Launch Infrastructure Without Central Approval

If developers, marketing or regional offices can create cloud resources or register domains, shadow IT is close to guaranteed. Continuous discovery catches new assets in days instead of at the next annual audit.

Your Asset Inventory Is Spread Across Tools

If you cannot say with confidence how many endpoints you have, or which ones lack EDR, CAASM is often the better first purchase than another scanner.

You Test Only What You Already Know About

If pentest and scanning scopes are built from a list somebody typed up years ago, unknown assets are never tested at all. ASM fixes the input to every other testing activity.

When A Lighter Approach Is Enough

A small company with one product, one cloud account and a handful of domains can often cover the basics with free tools, certificate transparency monitoring and a good vulnerability scanner. A dedicated platform starts to make sense when the inventory is too large or changes too fast to track by hand.

Questions To Ask An ASM Vendor

• How do you attribute assets to us? Ask to see the evidence trail behind a discovered asset and how false positives are handled.
• How often does discovery run? Daily, weekly or on demand, and how quickly a new subdomain shows up.
• What checks run against discovered assets? Passive only, light active checks, or deeper validation, and whether any of it can affect production.
• Do you cover internal assets? Some platforms are EASM only, some CAASM only, some both.
• How is risk scored? Ask which inputs drive prioritization and whether you can tune them.
• Which integrations are included? Ticketing, SIEM, cloud accounts and scanners, and whether they cost extra.
• Is human validation available? Some vendors route high-risk findings to analysts or testers before alerting you.

Frequently Asked Questions

Is Attack Surface Management The Same As Vulnerability Management?

No. Vulnerability management finds and fixes known weaknesses on assets you already track. Attack surface management finds the assets in the first place, including ones vulnerability management never knew about, and monitors how exposure changes over time.

Does ASM Replace Penetration Testing?

No. ASM is broad and mostly non-intrusive. It does not chain vulnerabilities, test business logic or prove impact, and it does not meet requirements for a penetration test in frameworks such as PCI DSS. Use ASM to keep pentest scopes accurate, then test. Our guide on how often to run a penetration test covers scheduling.

What Is The Difference Between EASM And CAASM?

EASM discovers internet-facing assets from the outside without credentials. CAASM builds an inventory from the inside by pulling data from tools you already run. Many organizations use both because each one finds things the other misses.

Is CTEM A Product I Can Buy?

Not as a single product. CTEM is a five-stage program framework. Vendors sell tools that support parts of it, such as ASM for discovery and BAS or automated pentesting for validation, but the program also depends on scoping decisions and remediation processes inside your organization.

Conclusion

Attack surface management gives security teams an accurate, continuously updated picture of what they own and what is exposed. EASM finds the unknown internet-facing assets, CAASM reconciles what your existing tools know, and CTEM is the program that turns those findings into validated, fixed exposures. None of them replaces a human-led penetration test. They make sure the test is pointed at the right things.

To compare tools, start with our list of top attack surface management platforms, then read what penetration testing is and how it builds on ASM. For every related guide and list, visit our penetration testing hub.