What is external attack surface management?

External attack surface management is the practice of continuously discovering, assessing and monitoring every internet-facing asset that belongs to — or looks like it belongs to — an organisation, from the outside, without credentials or agents. That includes domains and subdomains, exposed services, certificates, web applications, email and DNS posture, third-party hosts carrying your name, and lookalike domains or cloned sites operated by others. The distinguishing feature versus ordinary vulnerability scanning is discovery: EASM finds the assets you didn't know you had, not just the weaknesses in the ones you listed. Enterprise EASM platforms automate that discovery at scale; a small organisation can achieve the same outcome with public data sources and passive checks.

What is the difference between EASM and ASM?

Attack surface management (ASM) is the umbrella: everything an attacker could interact with, inside and outside the network. External ASM is the subset reachable from the internet — the perimeter as an outsider sees it. The other commonly named subsets are cyber asset ASM (the internal inventory of devices, cloud resources and accounts, usually built from your own systems of record) and digital risk protection (brand impersonation, leaked credentials, lookalike domains). Vendors combine these differently, which is why the acronyms overlap. For a company without a security team the external subset is where the unknowns live and where breaches start, so 'ASM' in practice means EASM plus basic internal hygiene like MFA and updates.

Is Microsoft Defender External Attack Surface Management worth it for a small company?

Usually not, unless you are already deep in the Microsoft security stack and have someone to work its findings. Defender EASM is priced per discovered asset and is designed for organisations whose footprint is genuinely unknown — subsidiaries, acquisitions, sprawling cloud estates — where seeded discovery pays for itself. A small company with one domain and a handful of subdomains can build the same inventory from Certificate Transparency logs and DNS in an afternoon, score each host with free passive checkers, and monitor the brand slice with a free tool. Revisit a platform when asset count outgrows a monthly manual pass or when a customer or regulator requires continuous evidence.

External Attack Surface Management (EASM) — Explained Without the SOC

External attack surface management (EASM) is attack surface management done from the internet inward: discovering, assessing and monitoring every asset that an outsider can reach — without any access to your network. It is the view attackers have, which is why it is the one to start with, and for most small organisations the only one that matters.

What counts as “external”?

Seven asset classes, in the order attackers usually enumerate them:

Domains and subdomains — everything that resolves under names you own, including hostnames created by SaaS tools and forgotten projects.
IP addresses and services — what answers on which port: web servers, mail, VPN gateways, RDP, databases that were never meant to face the internet.
Certificates — every TLS certificate issued for your names (public in Certificate Transparency), plus their expiry.
Web applications — the sites and APIs behind those hostnames, their frameworks, admin paths and exposed files.
Email and DNS posture — SPF, DKIM, DMARC, MX, and whether any of it lets a stranger send mail as you.
Third-party footprint — cloud buckets, CDNs, payment and analytics scripts, SaaS logins on your subdomains.
Brand and lookalikes — domains and certificates that resemble yours, and copies of your site served from someone else's host. Not yours, but very much on your external surface.

What EASM deliberately excludes: laptops, internal servers, identity providers, SaaS tenants' internal configuration. Those are the internal surface — important, but discovered and managed with different tools (endpoint management, IAM reviews, SaaS posture tools).

What do enterprise EASM platforms do — and what does a 10-person agency actually need?

Enterprise products (Microsoft Defender EASM, CyCognito, Cortex Xpanse, IONIX) solve a discovery problem: given a company name and a few seed domains, find every asset across subsidiaries, acquisitions and cloud accounts, keep re-finding it, score it, and push it into a ticketing system. Gartner's definition of the category centres on exactly that continuous, unseeded discovery (Gartner glossary). It is valuable when the inventory is genuinely unknown.

An agency with fifty client sites, or a company with one domain and a dozen subdomains, does not have an unknown inventory — it has an unwritten one. The need is smaller and different: write the list down once (CT logs + DNS make that an afternoon), score each host passively, remove what's dead, and monitor for the two things that change without permission: your own configuration drifting, and other people registering or cloning things that look like you.

A do-it-yourself EASM baseline

One pass per client or per domain; repeat monthly. Everything here is passive and free.

# 1. Hostnames from Certificate Transparency (the attacker's first step, too)
curl -s "https://crt.sh/?q=%25.client-domain.com&output=json" | jq -r '.[].name_value' | sed 's/\*\.//' | sort -u

# 2. What each hostname points at (CNAMEs to SaaS = third-party footprint; NXDOMAIN targets = takeover risk)
for h in $(cat hosts.txt); do echo "$h $(dig +short CNAME $h | head -1)"; done

# 3. Email posture per domain
dig +short TXT client-domain.com | grep spf; dig +short TXT _dmarc.client-domain.com; dig +short MX client-domain.com

# 4. What the internet already knows about your IPs (no scanning by you)
#    https://search.censys.io/hosts/<ip>   ·   https://www.shodan.io/host/<ip>

# 5. Per-host hygiene, passively: headers, cookies, CSP, TLS, exposed files
#    https://mysecscan.com/tools/website-security-score

Record the result as a table — hostname, owner, purpose, keep/retire, score — and you have the artefact an EASM platform would sell you, for your size of footprint. The mapping guide has a template.

Common gotcha: treating third-party hosts as “not our problem”. A help.client.com CNAME to a helpdesk SaaS, a blog.client.com on a managed platform, a marketing bucket — all of them carry the client's name and cookies' domain scope. You don't patch them, but you do inventory them, check their DNS record still points at something that exists (dangling CNAMEs are taken over routinely), and include them in monitoring.

When should you buy an EASM platform?

You cannot name your own assets — multiple business units, acquisitions, shadow IT — and discovery from a seed finds things nobody knew about.
You need continuous evidence for a customer, insurer or regulator (NIS2, DORA, SOC 2 questionnaires ask for it explicitly).
Findings must flow into ticketing and SLAs, and someone is paid to work the queue.
Your footprint exceeds what one person can re-inventory monthly — a few hundred hosts is the usual line.

Until then, the money is better spent on reducing the surface — every retired host is one that no platform ever needs to find.

For the site owner and for the developer

For the site owner (plain English)

“External attack surface” is everything a stranger on the internet can see of your company: your websites and all their subdomains, your email setup, your certificates, and anything that looks like you but isn't. Managing it means keeping that list short, keeping what's on it healthy, and getting told when something new appears. You can ask your agency or IT provider for the list today; if they can produce it and it has an owner next to each line, you are ahead of most companies your size.

The part of the external surface you can't inventory yourself — lookalike domains, impersonation certificates, cloned sites — is what the Domain Monitor watches for your verified domain. Free during the beta.

Monitor your domain →

For the developer / IT

Own the inventory file in version control, one row per hostname with owner, purpose and last-checked date; treat additions as pull requests. Point a monthly job at the baseline above and alert on diffs, not on the full output. Feed dangling CNAMEs and unknown hosts into the same backlog as bugs. For the brand slice — certificates and registrations that resemble your names — use CT and RDAP monitoring rather than trying to enumerate it yourself; the monitoring guide shows the sources.

External Attack Surface Management (EASM), Explained for People Who Don't Run a SOC