Attack Surface and Attack Path Analysis
External Attack Surface Management (EASM)
We identify your internet-facing assets as an attacker would. We highlight those missing from your inventory and those carrying risk, in order of priority.
What it is
Your external attack surface includes all assets belonging to your organization that are accessible from the internet. A subdomain, forgotten test server or cloud service is part of this surface. EASM finds these assets using open sources attackers use, such as DNS, certificate and IP records. Each asset is compared with your inventory, assigned to an owner and tracked for changes.
Scope
- Mapping domains, subdomains and DNS records
- IP ranges registered to your organization and exposed resources in your cloud accounts
- Identifying open services, management interfaces and remote access points
- Finding DNS records pointing to deleted resources and certificates nearing expiry
- Comparing each asset with the inventory and identifying its owner
The need
When organizations need it
- When you acquire a company and its internet-facing systems become your responsibility.
- When agencies or suppliers set up campaign sites or portals in your name.
- When a customer, researcher or supplier notifies you about a system not in your inventory.
Method
How we work
-
Starting points
We start with your company and brand names and known domains. We decide together whether subsidiaries are in scope.
-
Discovery
We find domains, IP addresses and cloud resources from open sources. We filter out assets belonging to other organizations with similar names.
-
Assessment
We examine open services and known vulnerabilities with non-intrusive checks.
-
Handover and tracking
We deliver the asset list with owners and priorities. If you wish, we continue to monitor changes at regular intervals.
Outcome
What you have at the end
You receive an up-to-date list of your internet-facing assets with their owners. Systems outside the inventory and services to close first are marked separately.
Frequently asked questions
How is EASM different from an external network penetration test?
A penetration test examines in depth the IP addresses and domains you provide. EASM first identifies which assets are yours, and therefore what should be tested.
Will the work affect our systems?
Most discovery uses passive sources. Active checks are low intensity and only run on assets confirmed to be yours.
What do you need from us?
Your company and brand names and known domains are sufficient. No access to your internal systems is required.
Attack Surface and Attack Path Analysis
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting