One queue
An expiring certificate or an exposed host sits beside the code and cloud findings for the same service, with the same severity scale.
EASM
External attack surface management (EASM),
watched for change.
External attack surface management (EASM) is the continuous discovery and monitoring of an organisation's internet-facing assets: domains, subdomains, hosts and certificates. It finds what an attacker can see from outside, including forgotten or unlisted systems, and alerts when the surface changes. SecurityVault puts every external finding on the same graph and remediation queue as your code and cloud findings.
External footprint
Domain
Discovered service
Exposure record
Investigation context
01 / Discover assets
Understand the visible footprint.
- Discovery source
- Asset identity
Bring discovered assets into a reviewable inventory.
02 / Review exposure
Open the service behind the signal.
- Service context
- Observed exposure
Inspect the exposure evidence and the asset it relates to.
03 / Assign follow-up
Connect the exposure to a team.
- Asset owner
- Investigation task
Coordinate investigation with the team responsible for the affected service.
Seeds
Admin-confirmed domains
Discovery starts only from what you confirm.
DNS · CT
Subdomain discovery
DNS enumeration and certificate transparency.
Diff
Change detection
Scheduled re-scans compared run to run.
Alerts
Where you work
Email, Slack, PagerDuty or webhook.
The category
What is external attack surface management?
Every organisation has more internet-facing systems than its asset register shows: a marketing site on a forgotten subdomain, a staging host left running, a certificate about to expire on a service nobody owns. EASM works from the outside in. It starts with the domains you own, discovers what hangs off them the way an attacker would, and keeps looking, because the attack surface changes every time a team ships. The value is not the first inventory but the alert when something new appears.
An alert on its own is one more console to watch. SecurityVault carries each external finding into the same graph and queue as your code, image and cloud findings, so an exposed host has an owner, a deadline and a link to the cloud posture behind it. Security teams get one programme instead of an outside-in inventory nobody acts on.
Domain
Establish the asset within the authorised scope.
Exposed service
Review the reachable service and its evidence.
Asset relationship
Connect the observation to the environment under review.
External observations become useful when the asset and ownership are understood.
How SecurityVault does it
How does SecurityVault map your attack surface?
Seed
An administrator confirms the seed domains your organisation owns. Discovery never starts from a domain that has not been confirmed.
Discover
DNS enumeration and certificate transparency logs find the subdomains and hosts beneath each seed. Connect your own SecurityTrails or VirusTotal keys and passive DNS history joins the sources.
Check
Each asset is checked for DNS configuration and TLS certificate issues, and technology fingerprinting records the technologies it presents, so you can see what each host exposes from the outside.
Watch
Re-scans run on your schedule. Each run is compared with the previous one, and new assets, changed certificates and other changes raise alerts by email, Slack, PagerDuty or webhook.
Govern
Asset inventory, monitoring alerts and newly discovered hosts each have their own view, so a security team can review what appeared since last week in one place.
Outcomes
What happens to an EASM finding?
It joins the same findings model as your code, dependency, image and cloud findings, so the internet-facing view and the inside view are one programme.
01
02
Owned
Findings route through your ownership mapping to the team responsible and receive a deadline from your severity-based SLA policy.
03
Connected
The outside view complements cloud posture: one shows what is reachable from the internet, the other how the cloud behind it is configured.
FAQ
Attack surface management questions
- What is the difference between EASM and vulnerability scanning?
- Vulnerability scanning tests assets you already know about. External attack surface management finds the assets first, including the ones nobody listed, and then keeps watching them for change. The two meet in SecurityVault because EASM findings land in the same queue as the rest of your vulnerability management.
- Which domains will SecurityVault discover from?
- Only seed domains that an administrator in your organisation has confirmed. Discovery starts from those seeds and expands to the subdomains and hosts found beneath them.
- How are subdomains discovered?
- Through DNS enumeration against your seed domains and certificate transparency logs, which record every publicly trusted certificate issued for a name. If you connect your own SecurityTrails or VirusTotal keys, passive DNS history is added as a further source.
- How often is the attack surface re-checked?
- On a schedule you set. Each run is compared with the last, and changes, such as a new host or a changed certificate, raise an alert by email, Slack, PagerDuty or webhook.
- Where do EASM findings go?
- Into the same findings model as code, dependency, image and cloud findings, with an owner, a severity-based deadline and the asset they affect. See remediation SLAs.
- What is shadow IT in attack surface management?
- Shadow IT is any internet-facing system the security team does not know about: a forgotten subdomain, a test host or a service launched outside the usual process. EASM surfaces it by discovering from your confirmed domains outwards rather than from an asset register inwards.
Related: cloud security posture management · DAST for internet-facing applications · API security · risk-based vulnerability management · SecurityVault for security engineering · SecurityVault for CISOs. Follow external exposure into the connected platform page.
See it on your stack
Bring one domain.
Confirm one seed domain and see the subdomains, certificates and technologies an attacker would find.