FortWatch.ai
The complete guide

External Attack Surface Management (EASM): The Complete Guide

External attack surface management (EASM) is the continuous work of finding everything your company exposes to the internet, testing it the way an attacker would, and fixing what matters first. This guide covers what your attack surface includes, how EASM works, how it differs from ASM, CAASM, vulnerability management and penetration testing, and how a small team with no security staff can run it.

Start free trialGet my assessment

By the FortWatch team · Last reviewed November 2026 · Sources listed at the end

example.com

Production · scanned today at 06:12

Monitored

Assets found

34

27 subdomains · 6 IPs

Open issues

5

2 critical

Scanners

13

on every asset

Subdomain points at a deleted Heroku app

shop.example.com CNAME example-shop.herokuapp.com, no app behind it

Critical

Subdomains

Exposed .env file

https://staging.example.com/.env answers 200 with database settings

Critical

Exposed files

phpMyAdmin login open to the internet

203.0.113.24:8080 serves the phpMyAdmin sign-in page

High

Ports

No DMARC policy on a domain that sends mail

example.com has MX records and no _dmarc record

High

Email

Certificate expires in 9 days

api.example.com, issued by Let's Encrypt

Medium

Certificates

Each one is an issue with its evidence and the fix, and FortWatch AI explains any of them in plain English.

On this page

  1. 01What is external attack surface management?
  2. 02What your external attack surface includes
  3. 03How EASM works
  4. 04EASM vs ASM, CAASM, vulnerability management and pentesting
  5. 05What to look for in an EASM tool
  6. 06EASM for teams with no security staff
  7. 07How FortWatch does it
  8. 08Further reading, glossary and free tools
  9. 09Frequently asked questions
  10. 10Sources
Definition

What is external attack surface management?

Your attack surface is every point where someone could try to get into your systems or get data out of them. NIST defines it as “the set of points on the boundary of a system, a system element, or an environment where an attacker can try to enter, cause an effect on, or extract data from” it. The external part is whatever of that is reachable from the public internet: your domains, the servers behind them, the services listening on their ports, and the certificates, mail records, apps, APIs and storage buckets anyone can query.

External attack surface management is the practice of keeping that external part known and safe. The UK’s National Cyber Security Centre describes EASM as “a subset of ASM” that “focuses on protecting online assets that are accessible from the internet”. In practice it means four things on repeat: discover what you expose, test it from the outside, rank what you find by real risk, and fix it before someone else finds it.

The defining trait is the viewpoint. EASM starts from a domain name, not from a list someone keeps in a spreadsheet, and looks at your company the way an outsider does: no agents, no credentials, no access to your cloud console. That is why it finds what inventories miss, such as the staging server from last year’s launch, the subdomain still pointing at a cancelled SaaS account, or the bucket a contractor made public.

Why it matters now

Scope

What your external attack surface includes

Nine kinds of asset make up the external attack surface of a typical software company. None of them is the headline: an exposed .env file, a missing DMARC record and an open database port sit on the same severity scale, judged by what an attacker could do with each.

Domains and subdomains

Every hostname under your domains: the app, the marketing site, docs and status pages, and the staging and preview hosts nobody remembers. Every TLS certificate you issue is written to public Certificate Transparency logs, so anyone can list your subdomains in seconds. Forgotten hosts run old software, and a DNS record left pointing at a service you no longer use can be claimed by a stranger, which OWASP’s testing guide covers as subdomain takeover. The registration is part of the surface too: a lapsed domain or an unlocked transfer can put everything under it in someone else’s hands.

In FortWatch

Check it free

Read

Glossary

IP addresses and open ports

Every service listening on a public address: web servers, SSH, remote desktop and mail, and the ones that should never be public, such as databases, caches and admin panels. MITRE ATT&CK lists exploiting public-facing applications and external remote services among the standard ways attackers get in. Unauthenticated databases are the sharpest case: in July 2020 an automated “Meow” bot wiped almost 4,000 unsecured databases it found exposed on the web. Judge a port by what answers on it, not by its number: MongoDB on port 9876 is as exposed as MongoDB on 27017.

In FortWatch

Read

Glossary

TLS certificates

The certificate on every HTTPS host and the TLS settings in front of it: expiry dates, protocol versions, cipher suites and the chain back to a trusted root. An expired certificate takes a product offline; an old protocol or a weak cipher weakens every connection. Renewal is getting more frequent: under a CA/Browser Forum ballot, the longest a public TLS certificate may be valid fell to 200 days on March 15, 2026, and falls to 100 days in March 2027 and 47 days in March 2029. A certificate renewed by hand will eventually be missed.

In FortWatch

Check it free

Read

Glossary

DNS and email records

The records that say where your traffic goes and who may send mail as you: SPF, DKIM, DMARC and MX, plus DNSSEC, CAA and your nameservers. Weak mail records let anyone send convincing email from your domain, and mailbox providers now expect them: Gmail’s sender guidelines require SPF or DKIM from every sender, and SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day. DMARC itself was updated in 2026 as RFC 9989. Context sets the severity: a missing DMARC policy on a domain that sends mail is far more serious than on one that never does.

In FortWatch

Check it free

Read

Glossary

Web applications and APIs

Everything that answers HTTP: your product, marketing site, docs, API endpoints and admin panels, and the frameworks, servers and libraries they run on. The risks are known CVEs in that stack, end-of-life runtimes that no longer get fixes, missing security headers (the OWASP Secure Headers Project lists which ones matter), and login and admin pages facing the internet. An admin panel such as phpMyAdmin, Kibana or a hosting control panel deserves a high rating however dull it looks: it is a login page for your infrastructure.

In FortWatch

Check it free

Read

Glossary

Cloud storage

Buckets and containers in AWS S3, Google Cloud Storage and Azure Blob Storage that carry your company’s name or are linked from your sites. On AWS, new buckets do not allow public access by default, so a public bucket is a setting someone changed, often for a quick file share that outlived its purpose. A listable bucket can expose backups, exports and customer files to anyone who guesses its name.

In FortWatch

Read

Glossary

Exposed files

Files your web server will hand to anyone who asks: .env files with production secrets, .git directories that rebuild your source code, database dumps, backup archives, config files and dependency manifests. OWASP’s testing guide treats old, backup and unreferenced files as a standard source of leaked credentials and infrastructure detail. A .env served at /.env.bak is as critical as one at /.env.

In FortWatch

Read

Glossary

Leaked credentials

Passwords, API keys and tokens that have escaped into public view: committed to public repositories, served in config files, or leaked in a third party’s breach. GitGuardian counted 28,649,024 new secrets in public GitHub commits in 2025, and found that 64% of the valid secrets it saw in 2022 were still exploitable four years later. A leaked key needs no exploit; it is a login. For staff addresses caught in other companies’ breaches, Have I Been Pwned’s domain search lists them once you verify the domain.

In FortWatch

Read

Glossary

Process

How EASM works

EASM is a loop, not a project. The NCSC’s buyer’s guide names ongoing automated discovery as the essential feature of an EASM product, and everything else follows from knowing what is there.

  1. 1

    Discover

    Start from your root domains and known IP ranges and expand outward. Certificate logs, passive DNS, search engines and DNS records turn one domain into the full list of hostnames, and each hostname leads to addresses, services and cloud resources. Discovery runs again on a schedule, because the surface changes every time someone ships.

  2. 2

    Inventory

    Record each asset with where it came from, what runs on it and when it was last seen. Mark what is out of scope instead of deleting it, so a host that comes back is noticed. An inventory with provenance is also the evidence a customer’s security questionnaire asks for.

  3. 3

    Test

    Check every asset from the outside, the way an attacker would: ports and the services behind them, TLS, DNS and mail records, HTTP headers, exposed files, known CVEs, cloud storage permissions and takeover-prone DNS. Tests must be safe for production: read-only requests and no destructive payloads.

  4. 4

    Prioritize

    Rank findings by what an attacker can do with them, not by count or raw CVSS score. CISA says organizations “should use the KEV catalog as an input to their vulnerability management prioritization framework”, and FIRST’s EPSS “estimates the probability that a published CVE will be exploited in the wild in the next 30 days.” Context matters as much: an exposed database is critical whatever port it listens on.

  5. 5

    Fix

    Turn each finding into a tracked issue with an owner, a deadline set by its severity and a fix written for the person who will make it. Keep the evidence beside it, so the engineer can confirm the problem before changing anything.

  6. 6

    Keep watching

    Re-test after every fix and on a schedule, close what the scan no longer finds, and alert on what changed: a new port, a new subdomain, a certificate close to expiry. Verizon’s 2026 report puts the median time to fully fix a known-exploited vulnerability at 43 days; continuous checks show you a new exposure on the day it appears.

Go deeper on the hardest step: how to prioritize vulnerabilities when everything looks critical and EPSS vs CVSS vs CISA KEV.

Comparisons

EASM vs ASM, CAASM, vulnerability management and penetration testing

These terms overlap, and vendors blur them. The short version: EASM looks at what is reachable from the internet, from the outside, all the time. The others look wider, deeper or less often, and most companies end up using more than one.

DisciplineThe question it answersWhere it looksHow it worksHow often
EASMWhat can an attacker on the internet see and reach of ours?Internet-facing assets only, including the ones you did not know aboutDiscovers and tests from the outside, starting from a domain name; no agents or credentialsContinuously
ASMWhere could an attacker get in, anywhere?The whole attack surface, internal and externalThe umbrella discipline; EASM is its external partContinuously
CAASMWhat assets do we have, according to our own tools?Internal and external assets your existing tools already know aboutPulls asset data from your tools through their APIs and merges it into one inventoryContinuously
Vulnerability managementWhich known weaknesses are on the systems we manage, and are they patched?Known hosts and software, often with agents or credentialsScans known assets, ranks the results and drives patchingIn recurring cycles
Penetration testingWhat could a skilled person actually do to us?A scoped set of targetsPeople simulate real attacks and chain small issues into a compromisePeriodically, often yearly or before a major release

EASM vs ASM

Attack surface management is the umbrella: every point where an attacker could get in, inside the network and out. EASM is its external part, and for a company whose product lives in the cloud it is most of the surface. Gartner, quoted by TechTarget, describes EASM tools as ones that “discover internet-facing assets and flag vulnerabilities that threat actors could exploit”.

EASM vs CAASM

Cyber asset attack surface management builds an inventory from the tools you already run, such as cloud accounts, endpoint agents and asset databases, and in TechTarget’s words focuses “on internal assets and exposures, as well as external issues.” CAASM answers “what do our tools know we have?” EASM answers “what can the internet see?”, including assets no tool of yours knows about. A small team with few tools to integrate usually starts with EASM.

EASM vs vulnerability management

Vulnerability management is the cycle of finding, ranking and patching known weaknesses on systems you manage; NIST describes the patching half as “identifying, prioritizing, acquiring, installing, and verifying” updates. EASM feeds it: it finds the assets nobody knew to scan, and the misconfigurations no patch fixes, such as a public bucket or a dangling DNS record. See vulnerability scanning inside EASM.

EASM vs penetration testing

Penetration testing is people testing you: in NIST’s words, “evaluators mimic real-world attacks in an attempt to identify ways to circumvent the security features” of a system. A good pentest goes deeper than any scanner, but it covers one scope at one moment. EASM covers the weeks in between and the assets nobody put in scope. Why continuous scanning beats annual pentests.

Buying

What to look for in an EASM tool

Most EASM tools demo well. The differences show up in week three, when the first wave of findings is fixed and you need to know whether to trust what is left. Check these eight things before you choose. The NCSC’s EASM buyer’s guide is the best vendor-neutral checklist, and our own buyer’s framework goes deeper.

Discovery from a domain name

It finds assets you did not tell it about, shows where each one came from, and keeps finding them on a schedule. A tool that only scans the list you type in is a scanner, not EASM.

Every surface on one severity scale

Ports, certificates, DNS and mail, headers, exposed files, cloud storage, takeovers and lookalike domains, all judged by impact. A tool strong on one category and blind to the rest leaves you stitching tools together.

Evidence on every finding

Each finding shows what was seen, when, from where, and how to reproduce it. Without evidence you cannot tell a real exposure from a false positive, and neither can the engineer you ask to fix it.

Prioritization by real risk

Ranking that uses exploitation data such as CISA KEV and EPSS and the asset’s context, not raw CVSS alone. The first screen should be the handful of things to fix today.

Fixes a developer can act on

Plain-language explanations and specific fix steps for your stack. If every finding needs a security engineer to translate it, the tool is built for a team you do not have.

Change detection and alerts

Alerts when something new appears or changes, sent where your team already works, with noise you can turn down without silencing real findings.

Scans only what you own

A responsible tool asks you to prove ownership before it runs active tests, and keeps its checks safe for production. That protects you and everyone else on the internet.

A workflow, not a report

Issues with owners and deadlines, issues that close when a rescan confirms the fix, reports for customers and auditors, and an API for everything else.

Evaluating an AI assistant as part of the tool? Use our nine-question live test for AI security copilots.

Small teams

EASM for teams with no security staff

Most small software companies have no one whose job is security. The work lands on a CTO, a lead developer or whoever runs the infrastructure, between other priorities. EASM suits that team better than most security tools: it needs no agents, no integrations and no network access, only the domains you already own. The NCSC makes the same point: EASM products “offer a lower barrier of entry into ASM for most consumers, compared to the cost and expertise of ‘in-house’ vulnerability scanning”.

Public help is moving to products as well. The NCSC retired its free Web Check and Mail Check services by March 31, 2026 and told organizations to find a commercial EASM product instead.

What a small team needs from EASM is different from what a security operations center needs: fewer, clearer findings, each with a fix a developer can apply, ranked so the first screen is the work for today. More on that in the SMB security gap, and in our pages for startups and for SaaS companies.

Your first week of EASM

  1. 1

    Day 1

    List what you know

    Write down your root domains, your cloud accounts and the IP addresses you know. Run the free Subdomain Finder on each domain and compare the result with your list. The difference is your shadow IT.

  2. 2

    Day 1

    Check mail and headers

    Run the DMARC & SPF Checker and the Security Headers Checker on your main domain. A missing DMARC record on a domain that sends mail is a same-day fix.

  3. 3

    Day 2

    Run a full outside-in scan

    Point an EASM tool at your domains, prove you own them and let it discover and test everything. FortWatch’s assessment gives you one full report on one domain.

  4. 4

    Days 3 to 5

    Fix the criticals first

    Close exposed databases and admin panels, remove .env and backup files from web roots, delete DNS records that point at services you no longer use, and rotate every secret that was exposed.

  5. 5

    Week 2 onward

    Make it routine

    Schedule scans, route alerts to where your team works, give every issue an owner, and spend half an hour a week on what changed. Five quick wins is a good companion list.

FortWatch

How FortWatch runs external attack surface management

FortWatch is AI-first external attack surface management for SMBs. It runs 13 scanners against every asset you add, keeps the inventory current, and uses AI to explain each finding in plain English and say what to fix first. The outside scan needs nothing installed; for Linux servers where you also want the inside view, the optional Server Agent adds it. FortWatch is built for the team that ships software faster than it can hire a security engineer.

SurfaceWhat FortWatch checksLearn more
Domains and subdomainsSubdomain discovery from certificate logs, DNS datasets and search engines once you prove ownership; takeover detection on dangling records; domain registration expiry, transfer lock and registrar changes over RDAP
IP addresses and open portsPort scans with service fingerprinting, with severity set by the service that answers, so a database on an unusual port is still critical; an external hardening audit per server
TLS certificatesExpiry, protocol versions, cipher suites and chain validation
DNS and email recordsDNSSEC, CAA, nameservers and dangling records; SPF, DKIM, DMARC and MX, with severity weighed by whether the domain handles mail
Web applications and APIsNuclei CVE checks, HTTP security headers, technology fingerprinting with end-of-life detection, screenshots, and on-demand web app and API testing from your OpenAPI description
Cloud storagePublic AWS S3, Google Cloud Storage and Azure Blob exposure
Exposed files and leaked secrets.env files, .git directories, backups, configs and dependency files served from your web roots
Lookalike domainsTyposquats and lookalikes of your domains
Inside your Linux servers (optional)The outside scan needs nothing installed. Where you also want the inside view of a Linux server, the optional Server Agent adds it: vulnerable packages, login accounts and SSH settings

AI triage in plain English

Ask FortWatch AI about any issue and get what it is, why it matters to you, how to fix it and how to keep it from coming back, plus a prompt your coding agent can run. Run the whole platform by chat, or from Claude, ChatGPT and Cursor through the MCP server.

Evidence you can check

Every open issue shows whether the exposure is confirmed, when and from which address it was last seen, the proof line from the scan, and a command you can paste to reproduce it.

Issues that close themselves

Findings become tracked issues with deadlines set by severity. When a rescan no longer finds the problem, the issue resolves on its own, and the history stays for your audit trail.

New threats, checked fast

On plans with emerging-threat scanning, a new critical or high check runs against your verified assets within about half an hour of its release, so you know the same day whether you are affected.

Scans only what you own

Before the full scan, FortWatch asks you to prove ownership with a DNS record or a file on the site. Until then you see what anyone can see from the outside.

One report to forward

The assessment report puts an AI-written summary, every critical, high and medium issue with its proof and fix, and what ran clean into one PDF or share link.

A FortWatch issue: Exposed .env File, critical and confirmed, with the time and address it was last confirmed from, the evidence line, what it means, how to fix it and the curl command that reproduces it

One issue as FortWatch reports it: severity, exposure state, evidence, fix and a command to reproduce it.

Start free trialGet my assessment
Go deeper

Further reading, glossary and free tools

Every FortWatch guide on the external attack surface, grouped by where you are.

Start here

Discovery, DNS and your domains

Exposures to find and fix

Prioritizing and fixing

Glossary

The full security glossary

Free tools: check your surface now

All free tools
FAQ

External attack surface management: frequently asked questions

What is external attack surface management (EASM)?

External attack surface management is the continuous practice of discovering every asset an organization exposes to the internet, testing those assets from the outside the way an attacker would, ranking what it finds by real risk, and tracking the fixes. It covers domains and subdomains, IP addresses and open ports, TLS certificates, DNS and email records, web apps and APIs, cloud storage, exposed files, lookalike domains and leaked credentials.

What is the difference between EASM and attack surface management (ASM)?

Attack surface management covers every point where an attacker could get in, inside and outside the network. EASM is the part that deals with what is reachable from the public internet; the UK National Cyber Security Centre describes EASM as a subset of ASM that focuses on online assets accessible from the internet. For a small software company with a cloud-hosted product, the external part is most of the surface.

How is EASM different from penetration testing?

A penetration test is people simulating a real attack on a scoped set of targets at one point in time, going deep and chaining small issues together. EASM is automated and continuous, and it finds assets nobody put in scope. A pentest shows what a skilled attacker could do that week; EASM shows what is exposed every day. Most teams run EASM continuously and commission a pentest when a customer, an auditor or a major release calls for one.

How is EASM different from vulnerability scanning?

A vulnerability scanner tests the hosts you give it for known weaknesses. EASM starts earlier: it discovers which hosts exist, including ones you did not know about, then tests them. It also covers problems that are not CVEs, such as weak DNS and email records, exposed files, public cloud buckets, subdomain takeovers and lookalike domains. Vulnerability scanning is one step inside EASM.

What is CAASM, and do I need it as well as EASM?

Cyber asset attack surface management (CAASM) builds an asset inventory by pulling data from the tools you already run, such as cloud accounts, endpoint agents and asset databases, through their APIs. It sees internal assets well but only knows what your tools know. EASM looks from the outside and finds what no tool of yours knows about. A small team with few tools to integrate gets more from EASM first; CAASM pays off once there is a large tool estate to reconcile.

How often should you scan your external attack surface?

Continuously, and at least daily for anything customers use. The surface changes every time someone deploys, adds a DNS record or opens a port, and attackers scan the internet all the time: researchers showed in 2013 that a single machine could scan every IPv4 address in under 45 minutes. A monthly scan can leave an exposure open for weeks before you see it.

Do small companies need EASM?

Yes. Automated attacks pick targets by what is exposed, not by company size, and small companies are less likely to have someone watching. EASM suits a small team because it needs no agents, integrations or network access, only the domains you own, and a good tool explains each finding well enough for a developer to fix it without a security specialist.

Can an EASM tool scan domains I do not own?

It should not run active tests on them. Passive discovery from public sources such as certificate logs and DNS can see anyone’s domain, but port scans and vulnerability tests belong only on assets you own or are authorized to test. FortWatch asks for proof of ownership, a DNS record or a file on the site, before it runs the full scan.

How do I get started with EASM?

List your root domains and the cloud accounts and IP addresses you know, then run an outside-in scan that discovers the rest. Fix exposed databases and admin panels, public files and dangling DNS records first, set up SPF, DKIM and DMARC, then schedule scans and route alerts to where your team works. FortWatch’s free tools give a first look in minutes, and its assessment gives one full report on one domain.

Sources

  1. Glossary: attack surface. NIST Computer Security Resource Center.
  2. External attack surface management (EASM) buyer’s guide. UK National Cyber Security Centre.
  3. Verizon DBIR: Vulnerability exploitation is the dominant initial access vector. Help Net Security, May 2026.
  4. Verizon DBIR 2026: Vulnerability Exploitation Is Now the #1 Way Breaches Start. watchTowr.
  5. ZMap: Fast Internet-wide Scanning and Its Security Applications. Durumeric, Wustrow and Halderman, USENIX Security 2013.
  6. RFC 9162: Certificate Transparency Version 2.0. IETF.
  7. Test for Subdomain Takeover (WSTG-CONF-10). OWASP Web Security Testing Guide.
  8. Exploit Public-Facing Application (T1190). MITRE ATT&CK.
  9. External Remote Services (T1133). MITRE ATT&CK.
  10. New ‘Meow’ attack has deleted almost 4,000 unsecured databases. BleepingComputer, July 2020.
  11. Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods. CA/Browser Forum.
  12. Email sender guidelines. Gmail Help.
  13. RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC). IETF.
  14. OWASP Secure Headers Project. OWASP Foundation.
  15. Blocking public access to your Amazon S3 storage. Amazon S3 User Guide.
  16. Review Old Backup and Unreferenced Files for Sensitive Information (WSTG-CONF-04). OWASP Web Security Testing Guide.
  17. Acquire Infrastructure: Domains (T1583.001). MITRE ATT&CK.
  18. The State of Secrets Sprawl 2026. GitGuardian.
  19. Domain search. Have I Been Pwned.
  20. Known Exploited Vulnerabilities Catalog. CISA.
  21. Exploit Prediction Scoring System (EPSS). FIRST.
  22. What is attack surface management? Guide for organizations. TechTarget.
  23. SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning. NIST.
  24. Glossary: penetration testing (definition from SP 800-115). NIST Computer Security Resource Center.
  25. NCSC Set to Retire Web Check and Mail Check Tools. Infosecurity Magazine.
Ready to secure your stack?

Secure your entire stack today

Start scanning in under 5 minutes. No credit card required. 7-day free trial included.

Start free trialGet my assessment