Request demo

Attack Surface Management

Discover Every Internet-Facing Asset and Keep Looking.

Attack surface management is the ongoing work of finding everything your organization exposes to the internet, checking it for weaknesses and keeping that picture current.

Teams run it on External Attack Surface Management: discovery from a seed domain, layer-by-layer scanning of approved assets and a scored queue that ends at a verified fix.

Request demo

Found from acme.example vpn-legacy.acme.example not in your inventory approved

Scanall checked

vpn-legacy.acme.example 203.0.113.24

  1. WHOISwhois

    acme.example · renews in 41 days

    snapshot 2026-09-24

  2. IP WHOISipwhois

    AS64500 · 203.0.113.0/24

    snapshot 2026-09-24

  3. DNSdns

    A 203.0.113.24

    snapshot 2026-09-24

  4. SSLssl

    *.acme.example · expires in 6 days

    snapshot 2026-09-24

    Medium

  5. Portsport_scan

    3389/tcp · remote desktop exposed

    snapshot 2026-09-24

    Critical

  6. Web datawebdata

    VPN login page

    snapshot 2026-09-24

  7. HTTPhttp

    200 · response headers

    snapshot 2026-09-24

Remote desktop exposed · Critical

state newly_detected

The Inventory Is Always a Step Behind.

A CMDB lists what someone registered. The internet shows what answers, and the gap between the two is where attackers start.

Drift

Assets Outlive Their Projects

A campaign microsite, a test server built for one release, a partner portal nobody switched off. Each keeps answering after its owner has moved on.

Growth

Group Companies and Acquisitions

Subsidiaries register their own domains. An acquisition brings infrastructure that nobody has inventoried under your name yet.

Change

Known Assets, Changing Quietly

A certificate expires, a port opens, a DNS record points somewhere new. A point-in-time scan only sees the day it ran.

EASM Takes Each Asset From Scope to Close.

Discovery decides what is in scope, scanning keeps it current, detection and scoring decide what matters, and remediation closes it out.

01

Asset Discovery

Starts from a seed domain and follows subdomains, the IPs they resolve to, and reverse IP, MX, NS and WHOIS pivots across Deepinfo’s index. Your team approves what belongs to you.

Discovery 02

Continuous Scanning

Scans every approved asset across WHOIS, IP WHOIS, DNS, SSL, ports, web data and HTTP, and keeps each layer as a dated snapshot.

Scanning 03

Risk Detection

Raises misconfigurations, weak TLS, expiring certificates, exposed services, public login pages, end-of-life technology and CVEs as issues with evidence.

Detection 04

Risk Scoring

Scores each asset and domain, and ranks each CVE by CVSS, EPSS and CISA KEV together.

Scoring 05

Remediation

Moves each issue through its states until a rescan confirms the fix, and reopens it if the signal returns.

Remediation

Domains, Subdomains and IPs in One Inventory.

The inventory lists all monitored domains, subdomains and IP addresses. Each one opens on its own record, with its issues, technologies, open ports and vulnerabilities one tab away.

  • All assets 1,562
  • Domains 3
  • Subdomains 1,312
  • IP addresses 247

Domains

  • A acme.example
    • A www.acme.example
    • B shop.acme.example
    • C vpn.acme.example
    • A mail.acme.example
    • 1,280 more
  • A acme-eu.example
  • C acme-labs.example

A acme.example

Last check 2 hours ago

  • Overview
  • Issues
  • Subdomains
  • Technologies
  • Open ports
  • Vulnerabilities
  • Asset info

Info

IP addresses

  • 203.0.113.10
  • 203.0.113.11
  • 203.0.113.12
  • +5

Insights

Issues
38
Subdomains
1,284
Technologies
23
Open ports
46
Vulnerabilities
7

From a Seed Domain to a Verified Fix.

  1. 01

    Seed

    Add your primary domain. If you already know more of your assets, add them too, in bulk through the API.

  2. 02

    Review

    Discovery candidates land in a queue. Your team approves what belongs to the organization, ignores what doesn’t, and can revert either decision.

  3. 03

    Scan

    Approved assets are scanned layer by layer. A new certificate, a DNS edit or a newly open port becomes an event.

  4. 04

    Prioritize

    Issues arrive with a severity from Critical to Information. CVEs are ranked by CVSS, EPSS and CISA KEV together.

  5. 05

    Close

    Owners work each issue through its states. A rescan confirms the fix, and a returning signal reopens the issue as reappeared.

What the Team Works From.

An inventory that matches what answers on the internet, where every addition is a recorded decision. Changes reach their owners, and reports serve the people tracking risk and the people fixing it.

Dated Snapshots

Each data layer scanned per asset and kept as a dated snapshot.

Issue States

Each issue tracked from newly detected to verified resolved.

Notifications

Changes delivered instantly, or as an hourly to monthly digest.

Reports

From executive summary to vulnerability detail, on demand or on a schedule.

Where This Workflow Leads Next.

Customer story A national telecom operator Continuous monitoring across tens of thousands of public-facing assets, with discovery across subsidiary brands. Read EASM External Attack Surface Management The module this workflow runs on: discovery, scanning, scoring and remediation. Read Use case Vulnerability Management Rank the CVEs on those assets by exploitation signal. Read

Use This Data in Your Tools

The discovery and scanning data behind this use case is open through the API, for teams that feed it into their own inventory or scanners.

Questions About Attack Surface Management

What do we need to start?

A seed, usually your primary domain. The platform proposes related assets and only approved ones join the monitored inventory. Discovery rules you trust can approve their own matches.

Is the scanning intrusive?

No. Nothing is installed and no access is requested: the platform reads what your assets already expose to the internet. Standard monitoring runs no authenticated scans, no exploit attempts and no load tests.

How is attack surface management different from an asset inventory?

An inventory lists what someone recorded. Attack surface management starts from what is reachable on the internet, keeps looking for assets that appear later, and checks each one for weaknesses on an ongoing basis.

How often are assets rescanned?

Approved assets are rescanned on the platform’s own schedule, without anyone triggering it, and each layer keeps its history. For a fresh result, start an instant scan on any asset from the platform or with one API call.

How does it relate to vulnerability management?

Vulnerability management works through the flaws on assets you already know. Attack surface management decides what those assets are in the first place and feeds new ones into the same queue.

See Vulnerability Management for how that queue is ranked.

Can the inventory feed our CMDB?

Yes. Asset search has an export twin that returns all matches as CSV or JSON without paging, and the approved inventory is available through the EASM API, so the CMDB can be reconciled against what answers on the internet.

Can subsidiaries be tracked separately?

Yes. Each group company can run as its own portfolio with its own asset list, issues and score, the way Third-Party Risk Management handles vendors. See Subsidiary Oversight.

See the Surface You Have.

Book a demo and watch discovery run against your primary domain with our team.

Request demo