EASM enables organizations to view their external attack surface through the eyes of an attacker and locate forgotten servers dating back 11 years. This chapter introduces External Attack Surface Management as a mature component of vulnerability management programs that was absent from earlier editions of the guide because the technology was considered exotic only a few years ago.
The core problem addressed by EASM is shadow IT located outside the organization on the publicly accessible perimeter. Typical large companies maintain a well-known and protected main website while simultaneously operating forgotten test servers deployed by contractors years earlier, legacy marketing subdomains running vulnerable CMS platforms, development-only API gateways, recently acquired subsidiary infrastructure, publicly readable cloud storage buckets, and VPN gateways with long-forgotten vulnerabilities.
Attackers continuously scan the internet and often possess greater knowledge of these assets than the organizations themselves. Verizon DBIR 2025 data shows attacks against edge devices and VPN infrastructure increased nearly eightfold in a single year, underscoring the risk posed by unmanaged external surfaces.
EASM differs fundamentally from conventional vulnerability scanners. Traditional scanners operate against a user-supplied list of IP addresses and domains, missing any assets unknown to the defender. In contrast, EASM begins with publicly available information about the organization and applies attacker-style reconnaissance techniques including DNS enumeration, Certificate Transparency analysis, and data from Shodan and Censys to build a comprehensive map of the external presence.
The process consists of four stages: discovery of assets through public sources, attribution and classification to correctly associate findings with the organization, vulnerability and misconfiguration detection with risk prioritization, and continuous monitoring because the attack surface changes constantly.
In practice, EASM regularly identifies abandoned test servers, exposed databases and RDP services, expired certificates, publicly accessible code repositories containing secrets, and outdated software on the perimeter. The technology has already located vulnerabilities that remained unpatched for six and eleven years in real environments.
Market leaders according to GigaOm Radar include Palo Alto Networks Cortex Xpanse and CyCognito, while the first Gartner Magic Quadrant for Exposure Assessment Platforms named Qualys, Rapid7, and Tenable as leaders. In Russia, domestic solutions such as PT EASM from Positive Technologies, BI.ZONE EASM, PenOps from CyberOK, CICADA8, F6 Attack Surface Management, and ScanFactory have entered the registry of Russian software and are seeing adoption among regulated organizations.
