Security teams protect what they know about. Attackers target whatever they can find. The gap between those two lists is where many breaches begin: a forgotten test server, a marketing site built by an agency years ago, a cloud storage bucket created for a single project and never closed. External Attack Surface Management exists to close that gap. This article explains what EASM is, why the attack surface keeps growing, what it includes, how the discovery and monitoring process works, and how EASM relates to vulnerability scanning and to external penetration testing.
The short answer
EASM answers a deceptively simple question: what does our organization look like from the internet? It continuously discovers internet-facing assets, including those nobody registered in an inventory, and flags the ones that are exposed, misconfigured, or vulnerable.
The key difference from traditional approaches is the starting point. Most security tools begin with a list of known assets and check them. EASM begins with nothing but the organization’s name and public footprint, and discovers assets the way an adversary would. That is why it so often finds things the organization did not know it owned.
Why the attack surface keeps growing
An organization’s external attack surface is not static. It expands constantly, often without the security team being involved, for reasons that are part of normal business:
- Cloud adoption. Teams can create servers, storage, and services in minutes, frequently outside central IT processes.
- Digital initiatives. Campaign sites, customer portals, and APIs are launched quickly, sometimes by external agencies or partners.
- Mergers and acquisitions. Each acquired company brings its own domains, systems, and legacy infrastructure.
- Remote work. Remote access gateways, collaboration tools, and SaaS applications multiply the points of entry.
- Shadow IT. Departments adopt tools and services on their own, without security review.
- Forgotten assets. Old environments, retired projects, and test systems often remain online long after anyone remembers them.
Each of these is legitimate on its own. Together, they mean that any inventory maintained manually is out of date almost as soon as it is written.
What makes up the external attack surface
The external attack surface includes every asset that can be reached from the internet and that is associated with the organization. The main categories are:
- Domains and subdomains, including those registered by business units, agencies, or subsidiaries.
- IP addresses and exposed services, such as web servers, remote access, databases, and administrative interfaces reachable from the internet.
- Cloud assets, including storage buckets, virtual machines, and managed services with public endpoints.
- Web applications and APIs, from main websites to small, forgotten portals.
- Certificates, whose public records often reveal subdomains and services.
- Third-party and supplier assets that are connected to or hosted on behalf of the organization.
- Brand-related assets, such as lookalike domains registered by others, which are not owned by the organization but are part of how attackers target it.
A useful way to think about it: if an attacker can find it by searching the internet for the organization’s name, it belongs to the external attack surface.
How EASM works
EASM operates as a continuous cycle rather than a one-time project. The typical stages are:
- Starting from known seeds, such as the organization’s main domains and brand names, EASM expands outward using public sources: DNS records, certificate transparency logs, internet-wide scanning data, and registration information. Each new asset found becomes a seed for further discovery.
- Each discovered asset is evaluated to confirm whether it actually belongs to the organization, belongs to a supplier, or is unrelated. Accurate attribution is what separates a useful inventory from a noisy one.
- Inventory and classification. Confirmed assets are recorded with context: what they are, who owns them, what technology they run, and how critical they are to the business.
- Risk assessment. Assets are checked for exposures such as outdated software, open administrative interfaces, weak configurations, expired certificates, or sensitive data publicly accessible. Enrichment with threat intelligence helps prioritize exposures that attackers are actively targeting.
- Prioritization and remediation. Findings are ranked by real risk, and the responsible teams fix, restrict, or decommission the asset.
- Continuous monitoring. The cycle repeats constantly, because new assets appear and existing ones change every week.
EASM is often described as one component of a broader approach called Continuous Threat Exposure Management (CTEM), which connects discovery, prioritization, validation, and remediation into a single ongoing program.
EASM, vulnerability scanning, and external pentest
These three practices are frequently confused because they all look at the organization from the outside. They answer different questions, and the differences matter when deciding what to invest in.
| Dimension | EASM | Vulnerability scanning | External pentest |
|---|---|---|---|
| Main question | What do we expose? | Which known weaknesses exist on known assets? | What can an attacker actually achieve? |
| Starting point | The organization’s name and public footprint | A predefined list of targets | A defined scope agreed with the client |
| Finds unknown assets | Yes, that is its core purpose | No, it checks only what it is given | Sometimes, during reconnaissance |
| Proves exploitation | No | No | Yes |
| Frequency | Continuous | Periodic or continuous | Periodic, typically annual or after changes |
| Main output | Living inventory and prioritized exposures | List of vulnerabilities by asset | Proven attack paths and business impact |
The practical conclusion is that none of the three replaces the others. EASM shows what exists, scanning checks known weaknesses at scale, and an external pentest proves what an attacker could actually do with them.
How EASM and pentest work together
EASM and penetration testing are most valuable when combined. A penetration test is only as good as its scope. If the organization does not know about an exposed asset, it will not include it in the scope, and the test will miss exactly the kind of forgotten system attackers love most. EASM fixes this by producing a current, complete inventory that makes pentest scoping accurate.
The relationship also works in the other direction. EASM flags exposures but does not prove whether they can be exploited or how far an attacker could go from them. A pentest takes the most significant findings and validates them, separating theoretical risk from real attack paths. Used together, EASM provides continuous visibility and pentest provides periodic proof.
Common findings and why they matter
The exposures EASM uncovers are often unremarkable individually and dangerous in combination. Typical findings include:
- Forgotten environments, such as old test or staging systems still online with outdated software.
- Exposed administrative interfaces, such as remote access panels or management consoles reachable from the internet.
- Misconfigured cloud storage that makes files publicly accessible.
- Unmaintained subdomains pointing to services that no longer exist, which in some cases can be taken over by third parties.
- Expired or misconfigured certificates that erode trust and can indicate abandoned assets.
- Assets managed by suppliers or agencies that the organization assumed were someone else’s responsibility.
What these findings have in common is that they sit outside the security team’s field of view. They are rarely the result of negligence. They are the natural consequence of a business that moves faster than its inventory.
How to build an EASM practice
Organizations getting started with EASM can follow a practical path:
- Define the seeds. List the main domains, brands, subsidiaries, and known IP ranges that will start the discovery process.
- Run an initial discovery. The first results usually reveal a significant number of unknown or forgotten assets, which should be reviewed rather than acted on all at once.
- Assign ownership. Every confirmed asset needs an owner. Assets without owners are the ones most likely to remain exposed.
- Prioritize by risk. Address exposed administrative interfaces, sensitive data, and outdated internet-facing software first.
- Decommission what is not needed. Removing unnecessary assets is often the fastest and cheapest way to reduce risk.
- Integrate with existing processes. Feed new assets into vulnerability management, pentest scoping, and change management, so EASM becomes part of daily operations rather than a separate report.
- Measure the trend. Track the number of unknown assets discovered, the time to remediate critical exposures, and whether the attack surface is shrinking or growing.
How Mercurius approaches external attack surface management
Mercurius approaches the external attack surface the way an attacker would, which is natural for a team whose core is offensive security. Continuous discovery maps what the organization actually exposes, attribution separates the client’s assets from noise, and exposures are prioritized according to how attackers operate, informed by threat intelligence.
The difference is what happens next. Because the same team performs penetration testing, the most significant exposures can be validated with real exploitation, and the current inventory feeds directly into accurate pentest scoping. The result is a continuous view of the attack surface combined with periodic proof of what truly matters, so remediation effort goes where it reduces the most risk.
Frequently asked questions
What is the difference between EASM and a vulnerability scanner?
A vulnerability scanner checks a predefined list of known assets for known weaknesses. EASM starts without that list and discovers assets from the outside, including ones the organization did not know about. Scanning answers what is wrong with known assets. EASM answers what assets exist in the first place.
Does EASM replace a penetration test?
No. EASM provides continuous visibility of what is exposed but does not prove whether exposures can be exploited or what an attacker could achieve. A penetration test provides that proof. The two are complementary, and EASM makes pentest scoping more accurate.
What is shadow IT, and why does it matter for EASM?
Shadow IT refers to systems and services adopted by business areas without the knowledge or approval of IT and security. These assets are rarely monitored or maintained, which makes them attractive to attackers. Discovering shadow IT is one of the main benefits of EASM.
How often should the attack surface be assessed?
Continuously. New assets appear and existing ones change every week as the business evolves. A point-in-time inventory becomes outdated quickly, which is why EASM is designed to run as an ongoing process.
Is EASM relevant for mid-sized companies?
Yes. Mid-sized companies often have fewer people managing infrastructure, more reliance on agencies and suppliers, and less complete inventories, which makes unknown assets more likely. Continuous visibility of the external attack surface is one of the most cost-effective ways for them to reduce risk.
