Security engineering · Specialist service
External Attack Surface Management — EASM
A forgotten subdomain or unnecessarily exposed service can fall outside your IT inventory. We help identify your organisation’s external assets and structure actions to reduce unwanted exposure.
Service scope
External attack surface
External Attack Surface Management identifies domains, subdomains, public addresses, services and cloud resources associated with an organisation. Before assigning priority, we confirm the connection to the company and the asset’s purpose. Findings lead to inventory updates and tasks for responsible owners.
Asset reconnaissance
We identify the agreed scope of domains, subdomains, addresses and services using available information about the organisation.
Confirming ownership and responsibility
We verify ownership or responsibility for discovered assets, reducing incorrect attribution of supplier and third-party infrastructure.
Exposure assessment
We analyse whether a service’s public availability and characteristics match its purpose and the agreed exposure rules.
Remediation priorities
We identify assets to disable, restrict or investigate further, and agree how completion of recommendations will be verified.
Project deliverables
What will your team receive?
- Register of identified assets with confirmed organisational connections.
- Map of significant external exposures.
- List of recommendations, priorities and task owners.
- Results of agreed verification after changes.
Delivery conditions
What do we agree before starting?
- Initial list of domains, organisations and known assets.
- Agreed ownership verification rules and permitted checks.
- Contacts for administrators and external service owners.
How we work
From understanding the need to verifying the result.
Establish starting points
We agree organisational, domain and responsibility boundaries and permitted discovery methods.
Identify and verify
We discover assets, confirm their connection to the organisation and assess the significance of their exposure.
Organise and control
We assign tasks to owners, update the register and verify agreed changes.
Clear responsibilities
What is already included, and what do we extend?
Enterprise includes core vulnerability management for known assets on an agreed cycle. The EASM extension discovers a broader attack surface and assets missing from the inventory. It does not automatically include penetration testing.
Before making a decision
Questions about the external attack surface
Do you analyse assets missing from our inventory?
Yes, discovering them is one of the service objectives. However, their connection to the organisation must be confirmed before they are treated as its responsibility.
Is a publicly visible service always a problem?
No. We assess its purpose, the justification for exposure and available security controls. Public availability may be a legitimate part of the architecture.
Does EASM replace vulnerability scanning?
It complements scanning with asset discovery and context. Deeper vulnerability assessment and penetration testing have their own scopes, methods and delivery rules.
Related expertise
Connect activities that complement each other.
The next step
Let us define a scope that makes sense for your organisation.
Let us discuss your environment, priorities and team responsibilities. We will use this to define the work, required access and service conditions.