ASM Explained — Attack Surface Management / EASM, CAASM, DRPS

The attack surface is "the set of every point at which an attacker can attempt some operation against the organization (every entry point)". NIST defines it as the set of paths an attacker can use to enter a system or extract data from it. In practice, it gets organized along three axes:

"You don't measure attack surface by size" matters too. One forgotten admin console can be more fatal than ten thousand servers. The essence of ASM isn't volume; it's terrain awareness — knowing where what sits, and what is visible from outside.

The reason ASM detached from "a subset of vulnerability management" into a discipline of its own traces to the fact that, from the late 2010s into the 2020s, the structure of enterprise attack surface itself changed fundamentally.

• Cloud and SaaS explosion — In the on-prem era, "the company's IP range" was synonymous with "the attack surface." Today, AWS / Azure / GCP accounts are scattered across hundreds, and SaaS tenants (Salesforce / Workday / Slack / Snowflake) get signed up by marketing without IT involvement. The very concept of "our IP range" no longer holds.
• M&A — At large companies, 30–50% of the attack surface belongs to acquired subsidiaries. Marriott's 500-million-record breach (2018) originated in the Starwood reservation system, which was already compromised at the time of acquisition.
• Shadow IT — Business units open AWS accounts without CISO approval, stand up PoCs, and walk away. Old subdomains live on after the original owner has left, kept alive only because someone's still renewing the registration.
• Remote work — Since COVID-19, internal servers got published via VPN and home equipment became part of the work environment. The premise of perimeter defense collapsed.
• The attacker economy — Initial Access Brokers (IABs) sell "footholds inside organizations" as a commodity in a mature marketplace. Shodan data shows that the median time from a newly-public IP to its first scan is under 30 minutes.

ASM is not a single field. Three closely-related markets sit side by side under the ASM umbrella.

• EASM means "viewing the company's footprint from outside" — it scans the Internet the way an attacker would, and its main objective is discovering unknown public assets
• CAASM means "unifying the data you already have" — it ingests existing tools' APIs and builds a single inventory; cross-cutting queries like "endpoints without EDR" become possible
• DRPS means "watching external threats that touch the organization" — it covers things the org doesn't own but that affect it: phishing domains, leaked credentials, social impersonation

How does EASM go from "one seed domain" to mapping a whole company's attack surface? It is the attacker's recon workflow, scaled and automated — chaining multiple data sources together by pivoting.

The result is an asset map containing thousands to tens of thousands of items — most of them "old admin consoles / dev environments / pre-acquisition residue / shadow IT cloud accounts the org didn't realize it owned".

Attribution signals commonly used #

• favicon hash (MurmurHash3) — sites returning the same favicon image are likely from the same in-house template
• JARM (TLS fingerprint) — same TLS stack settings → likely on the same infrastructure
• Certificate SANs — domains listed in a single wildcard certificate (high confidence)
• HTML template similarity — sites sharing a common in-house base HTML
• WHOIS / RDAP contacts — reverse lookup on contact email / organization name (often anonymized by WHOIS privacy)
• Shared DNS NS — sites pointing to the same authoritative DNS servers

The operational cycle that makes ASM actually function has 5+1 stages: Discover → Inventory → Classify → Prioritize → Remediate → continuous. The single most common reason ASM deployments fail is "stopping at Discover" — a list of findings handed to the CISO is worth nothing if nobody knows what to do with it.

Make the KEV catalog a top priority condition #

The modern standard is to make KEV (CISA Known Exploited Vulnerabilities) a top-tier priority criterion. "Vulnerabilities attackers are actually exploiting" take precedence regardless of CVSS score. CISA BOD 22-01 (2021) requires US federal agencies to patch KEV-listed vulnerabilities by deadline. Increasingly, the private sector treats KEV as the SLA basis as well.

The techniques ASM uses are essentially identical to the attacker's reconnaissance phase. MITRE ATT&CK TA0043 (Reconnaissance) sub-techniques — Gather Victim Network Information / Search Open Websites / Search Open Technical Databases — describe exactly what an EASM does.

Difference vs. pentest: pentest "drills deep into a given scope," whereas ASM "decides what the scope is." ASM's output becomes the next pentest's input, filling the very real gap of "wait, what's our scope again?" that most companies cannot answer.

The ASM market is growing rapidly, with EASM becoming a standalone category in the Gartner Magic Quadrant starting in 2022.

Commercial #

• EASM — Cortex Xpanse (Palo Alto) / Defender EASM (Microsoft, formerly RiskIQ) / CrowdStrike Falcon Surface / Censys ASM / Mandiant ASM / Tenable / Qualys CSAM / IONIX
• CAASM — Axonius (400+ connectors) / JupiterOne / runZero / Sevco / Lansweeper / Panaseer
• DRPS — Recorded Future / ZeroFox / Flashpoint / Cyberint / Intel 471

OSS (also used routinely in bug bounty / pentests) #

• Attribution false positives — something tagged as "yours" turns out to belong to a different organization (e.g. a different tenant on the same AWS IP). Reviewing EASM low-confidence findings by hand has to be part of the workflow
• Ticket backlog — large volumes of vulnerability tickets pile up because the owner is unknown. The "decide-the-owner workflow" must be in place before deploying ASM
• The "everything is High" problem — sorting on CVSS alone produces thousands of Highs. Ranking has to be executable along three axes: KEV + exposure + business criticality
• SaaS often falls out of scope — the Snowflake incident's missing-MFA pattern slipped through exactly this gap. Integrating SaaS APIs via CAASM is the modern answer
• Ephemeral cloud assets — containers, serverless, spot instances vanish in hours. They have to be combined with CSPM / CNAPP
• M&A subsidiaries are blind spots — subsidiaries not yet integrated into the parent AD are hard to bring into ASM scope. To avoid repeating the Marriott / Starwood failure, "add the seed at acquisition time" needs to be a process
• The gap between "discover" and "pentest" — knowing something is there doesn't tell you if you can actually break in. CTEM's inclusion of "validation after discovery" in the cycle exists exactly to close this gap
• Detection noise and SOC fatigue — DRPS phishing-domain alerts can run into the hundreds per day. Automated takedown requests and noise filtering need to be in place from day one

• ASM is a field built backwards from the assumption "no organization can fully inventory its own attack surface." It crystallized as an independent market in 2018-2020
• EASM (view from outside) / CAASM (aggregate internal + external APIs) / DRPS (the threat landscape around the organization) are the three sub-disciplines under the ASM umbrella
• From 2024 onward, the trend is to fold them all under the CTEM framework — unifying discover → prioritize → validate → mobilize
• Technically it's the same toolset as attacker recon (CT / passive DNS / Shodan / Censys / favicon hash / JARM), used "before they do"
• What commercial vendors add is continuity + attribution precision + ticketing + dashboards. The core capability is achievable in pure OSS
• Whether ASM works depends on "what happens after discovery." Equifax / Capital One / ProxyLogon / MOVEit / Snowflake all share the property that some step in the cycle was broken