CyberGlossary

Defense & Operations

External Attack Surface Management (EASM)

Also known as: EASM

Definition

Continuous discovery and monitoring of all internet-facing assets that belong to an organization, viewed from an outside-in attacker perspective.

EASM focuses specifically on assets exposed to the public internet: domains, subdomains, IP ranges, cloud workloads, SaaS instances, certificates, exposed services, and leaked code or credentials. Platforms use DNS data, BGP, scanning, certificate transparency logs, dark-web feeds, and OSINT to map what an attacker can see without any internal access. Identified assets are attributed to business units, scored for risk, and tracked over time as the attack surface changes. EASM is widely used to find shadow IT after acquisitions, identify unmanaged cloud accounts, and reduce the noisy gap between security inventory and reality.

Examples

  • EASM discovering an unmanaged Azure tenant created by a marketing team that hosts production data.
  • EASM flagging a soon-to-expire wildcard certificate on a customer-facing subdomain.

Related terms