What is attack surface management? Understanding your attack surface.

Definition: What is the attack surface?

The attack surface comprises every point an attacker can target: domains and subdomains, public IP addresses, open ports, web applications, cloud services, access points such as VPN and remote desktop, but also user accounts and permissions. Every new system, every cloud service and every forgotten test system makes it larger.

Attack surface management makes this surface visible – not once, but continuously, because it changes every day.

External and internal attack surface (EASM)

A distinction is made between the external attack surface – everything reachable from the internet – and the internal attack surface within your own network. External attack surface management (EASM) focuses on the external part and works from the outside, without agents: It starts from a domain or company name and finds connected assets via DNS, certificates, IP ranges and its own scans.

Externally in particular, systems often turn up that are not in any inventory: old campaign sites, test environments, cloud services booked by business units (shadow IT).

How attack surface management works

• Discover: identify assets from public sources and own scans.
• Inventory: assign owners, business value and origin to each asset.
• Assess: check vulnerabilities, misconfigurations and reachability.
• Prioritize: sort by actual risk, not by number of findings.
• Monitor: report changes such as new ports or expiring certificates immediately.

Why ASM matters for NIS2 and ISO 27001

Without an up-to-date inventory, risks can be neither assessed nor treated. ISO/IEC 27001 requires an inventory of assets (Annex A 5.9), NIS2 requires appropriate risk management including vulnerability handling. ASM provides the technical foundation for this and the evidence that the inventory is maintained continuously.

ASM, vulnerability management and exposure management

ASM answers the question “What do we have?”. Vulnerability management asks “Where are these systems vulnerable?”. Exposure management combines both and asks “Which of these vulnerabilities actually lead to our critical systems?” – for example via attack paths. Together they form the core of continuous threat exposure management (CTEM).