External Attack Surface Management: Finding What You Forgot You Exposed

External attack surface management (EASM) is the ongoing work of finding everything your company exposes to the internet, checking it for weaknesses, and watching for changes. That includes domains, subdomains, cloud hosts, open ports, login pages, certificates and forgotten test systems. It answers a question scanners and pentests assume you already know: what do we actually have out there?

Why external attack surface management matters for a small company

Most breaches of small and mid-sized companies do not start with a clever exploit against the main product. They start with something nobody was watching. A staging server from two years ago. A marketing microsite on an old content management system. A database a contractor opened to the internet for a demo. A subdomain still pointing at a cloud service the company no longer pays for.

None of those are in the asset list, so none of them are in the vulnerability scan, so none of them get patched. Attackers do not need your asset list. They scan the whole internet continuously and find these systems on their own.

That is the whole case for attack surface monitoring at a small business. You cannot protect what you do not know exists, and in a growing company the list of things that exist changes every week. Every new SaaS tool, cloud project and marketing campaign can add something.

What does an external attack surface include?

Think of it as everything a stranger could find and touch from the internet without logging in first.

Asset type	Examples	Typical problem
Domains and subdomains	app., api., staging., old-campaign.	Forgotten hosts and subdomain takeover
Cloud hosts and IP ranges	VMs, load balancers, container endpoints	Unpatched services, default configurations
Open ports and services	SSH, RDP, databases, admin consoles	Management interfaces exposed to everyone
Web applications and APIs	Customer app, partner API, internal tools	Login pages without MFA, outdated frameworks
Certificates	TLS certificates on every hostname	Expiry, and hostnames revealed in public logs
Storage	Buckets, blobs, public file shares	Files readable by anyone with the link
Third-party surfaces	Help desk, status page, docs site	DNS still pointing at cancelled services
Code and credentials	Public repositories, packages, paste sites	API keys and secrets committed by mistake

How to find forgotten subdomains and exposed services

You can do a lot of discovery yourself with public data. It is worth doing once by hand so you understand what an attacker sees.

Start with certificate transparency logs

Publicly trusted TLS certificates are recorded in public certificate transparency logs, a system described in RFC 6962. Every hostname you ever got a certificate for is listed there, including the ones you forgot. Searching those logs for your domain is one of the fastest ways to find old subdomains.

Check DNS for dangling records

Go through your DNS zones and look for records pointing at services you no longer use: a cancelled hosting account, a deleted cloud bucket, an old help desk. If the record still points there and someone else can claim that resource, they can serve content on your subdomain. This is called subdomain takeover, and it is one of the most common findings in external work.

Pull lists from your cloud and billing accounts

List every public IP and load balancer in every cloud account, including the ones engineering set up for experiments. Then check the company card statements for hosting and SaaS providers that are not in your asset list. Shadow infrastructure usually shows up in the expenses before it shows up anywhere else.

Scan what you found

Once you have a list, scan it for open ports and identify the software running on each. Look first for management interfaces (remote desktop, SSH with passwords, database ports, admin panels) and anything running software with a known exploited vulnerability. CISA keeps a Known Exploited Vulnerabilities (KEV) list, which is a good filter for what to fix first.

Our free external exposure snapshot runs a lighter version of this against your domain if you want a starting point.

ASM vs vulnerability scanning vs penetration testing

These three get confused because they overlap. The simplest way to separate them is by the question each one answers.

	Attack surface management	Vulnerability scanning	Penetration testing
Question	What do we have exposed?	What known weaknesses do our listed assets have?	Can someone actually break in, and how far can they get?
Input	Your domains and company name	A list of hosts you provide	An agreed scope
Frequency	Continuous	Weekly to monthly	Once or twice a year, and after major change
Finds unknown assets	Yes, this is the point	No	Sometimes, within scope
Human exploitation	No	No	Yes
Typical output	Asset inventory and change alerts	List of findings by severity	Report with attack paths and fixes

They work best together. ASM keeps the asset list honest, scanning checks that list on a schedule, and a pentest shows what a skilled person could do with what is there. Our posts on vulnerability management vs penetration testing and penetration tests vs vulnerability scans go further into the last two.

What continuous monitoring catches that a yearly test misses

A penetration test is a snapshot. It is accurate on the days it runs and starts going out of date the day after. External attack surface management fills the eleven months in between. The things it catches most often:

• New hosts nobody announced. A developer spins up a test environment with production data and a public IP.
• Ports that open after a change. A firewall rule added during troubleshooting and never removed.
• Newly published vulnerabilities in software you already run. Your VPN appliance or file transfer server was fine last month and now has a critical advisory.
• Expiring or misissued certificates. An expired certificate on a customer-facing host is an outage and a trust problem.
• DNS drift. Records left pointing at resources that were deleted.
• Leaked credentials. Keys pushed to a public repository or published in a package.

The value is in the alert arriving within days of the change, while the person who made it still remembers why. Our post on how fast to patch critical vulnerabilities covers what to do once one of these lands.

How to run attack surface monitoring without a security team

You do not need a security operations centre to do this well. You need three things.

1. A defined seed list. Your registered domains, cloud accounts and company names. Update it when you buy a domain or open an account.
2. A named owner for every alert. Monitoring that sends findings to a shared inbox nobody reads is worse than none, because it creates a record that you knew.
3. A decision for every asset. For each new thing found, the answer is one of three: it is ours and it belongs (add it to the inventory and the scan), it is ours and it should not exist (shut it down), or it is not ours (record why). Unknown is not an answer.

Feed the confirmed assets into your asset inventory. If you are working toward SOC 2 or ISO 27001, that inventory is evidence an auditor will ask for, and an inventory checked against what is actually on the internet is far more defensible than one assembled from memory. See building an asset inventory for SOC 2 for what auditors expect.

What external attack surface management costs

Cost depends on how many domains and cloud accounts are in the seed list, how often discovery runs, and whether a person reviews and verifies findings or you get raw tool output. Raw output is cheap and noisy. Verified findings with an owner and a fix cost more and are the version teams actually act on.

Our attack surface management service starts from $750 a month and includes human review of what is found, so alerts arrive as decisions rather than as a list to sort.

Common questions about external attack surface management

What is external attack surface management?

External attack surface management is continuous discovery and monitoring of everything your organization exposes to the internet: domains, subdomains, cloud hosts, open services, certificates and leaked credentials. It finds assets you did not know about, checks them for weaknesses, and alerts you when something new appears or changes, so issues are fixed before an attacker finds them.

Does a small business need attack surface monitoring?

Usually yes, once you have more than a handful of internet-facing systems or more than one person creating them. Small companies are scanned by attackers as often as large ones and have less staff to notice drift. A lightweight setup with a seed list, monthly review and a named owner covers most of the risk.

Is attack surface management the same as vulnerability scanning?

No. Vulnerability scanning checks a list of assets you already know about for known weaknesses. Attack surface management builds and maintains that list by discovering what is exposed, including systems nobody recorded. Scanning without discovery leaves the forgotten hosts unchecked, which is where many real incidents begin.

How do attackers find forgotten subdomains?

Mostly from public data: certificate transparency logs that list every hostname issued a certificate, DNS records, search engines and internet-wide scan databases. None of this requires access to your systems. Running the same searches on your own domains shows you what they can already see.

Does ASM replace a penetration test?

No. ASM tells you what is exposed and alerts on change. A penetration test has a person attempt to exploit what is in scope and show how far they get. Most auditors and enterprise buyers still expect an annual penetration test. ASM makes that test better by making sure the scope is complete.