# External Attack Surface Management: A Practical Guide > Learn what EASM is, how external assets are discovered, how exposure changes, and how continuous monitoring supports an accurate internet-facing inventory. Canonical: https://sentryxmonitor.com/learn/external-attack-surface-management/ Last updated: 2026-08-08 EASM knowledge pillar External Attack Surface Management, or EASM, is the continuous discovery, classification, and monitoring of internet-facing assets such as domains, subdomains, IP addresses, certificates, DNS records, web applications, APIs, and exposed network services. Reviewed 2026-08-08 Read-only educational guidance ## Key points - An external attack surface is the set of systems and signals reachable or observable from the public internet. - EASM begins with discovery, but its long-term value comes from ownership, prioritization, and change monitoring. - EASM is different from vulnerability scanning, penetration testing, cloud posture management, and uptime monitoring. - A trustworthy program treats every finding as an observation that needs ownership and business context. ## What is an attack surface? An attack surface is every point where an unauthorized person could try to interact with a system, obtain information, or influence behavior. It includes technical interfaces such as web applications, APIs, remote administration services, cloud endpoints, DNS records, identities, and software dependencies. Internal and human attack surfaces matter too, but EASM concentrates on what can be observed from outside the organization. ## What is an external attack surface? The external attack surface is the internet-visible portion of that larger attack surface. It is not limited to the corporate website. A company may expose forgotten subdomains, staging systems, vendor-hosted portals, load balancers, VPN gateways, mail services, object storage endpoints, certificates, and IP addresses. Some assets are intentional, while others appear through acquisitions, temporary projects, DNS drift, or shadow IT. ## What is EASM? EASM is an operating process for keeping the external asset inventory current and reducing unmanaged exposure. It combines discovery data with validation, ownership, prioritization, and continuous monitoring. The goal is not to produce the largest possible list. The goal is to identify assets that plausibly belong to the organization, understand what each asset exposes, and route meaningful changes to the people who can act. ## How does EASM work? A typical workflow starts with known seeds such as domains, IP ranges, certificate names, cloud identifiers, and company-owned brands. Discovery expands those seeds using DNS, certificate transparency, public routing data, HTTP metadata, and other lawful public sources. The resulting candidates are validated, deduplicated, classified, assigned to owners, and monitored for changes. Strong programs repeat this cycle because internet-facing infrastructure changes continuously. ## What assets can EASM discover? Common asset types include apex domains, subdomains, IP addresses, autonomous-system ranges, TLS certificates, web applications, APIs, mail gateways, VPN endpoints, remote administration services, cloud-hosted applications, CDN endpoints, DNS records, and open TCP services. Discovery confidence varies. A certificate name or DNS relationship is evidence of association, not proof of current ownership, so validation and owner confirmation remain important. ## How do attackers discover internet-facing assets? Attackers use many of the same public signals defenders can observe: DNS records, certificate transparency logs, search engines, internet-wide scan datasets, public code, cloud naming patterns, HTTP headers, archived pages, and exposed service banners. They combine weak clues until they find an overlooked system. Defenders can reduce that asymmetry by running repeatable discovery before an attacker does. ## What are shadow IT and exposed services? Shadow IT is technology used without the normal ownership, security, or procurement path. It may be a legitimate marketing tool, a temporary cloud host, or a test environment that outlived its project. An exposed service is a network service reachable from the internet. Exposure is not automatically a vulnerability, but unnecessary reachability, weak authentication, old software, and missing monitoring increase risk. ## How is EASM different from vulnerability scanning? A vulnerability scanner usually evaluates known targets for known weaknesses. EASM asks a prior question: what targets exist, which ones belong to us, and how has that set changed? The practices complement each other. EASM expands and maintains scope; vulnerability management evaluates and remediates weaknesses inside that scope. ## How is EASM different from penetration testing? Penetration testing is a time-bound, authorized attempt to demonstrate exploitable paths and impact. EASM is continuous, broad, and normally non-exploitative. It observes assets and exposure so teams can decide what needs deeper assessment. EASM does not replace a penetration test, and a penetration test does not keep the internet-facing inventory current between engagements. ## How is EASM different from uptime monitoring? Uptime monitoring checks whether selected services remain reachable and responsive. EASM discovers and classifies the wider external inventory, including systems nobody has chosen to monitor yet. Once EASM identifies a business-critical endpoint, uptime, DNS, TLS, and change monitoring help maintain operational visibility. ## How does continuous monitoring work? Continuous monitoring repeats selected observations on a schedule and compares the result with a known baseline. Useful changes include a new subdomain, a different DNS target, a certificate nearing expiration, a service appearing on a port, an HTTPS error, or a security header disappearing. Alerting should favor meaningful state transitions and ownership context over raw scan volume. ## Where does Sentryx Monitor fit? Sentryx Monitor provides a read-only outside-in scan of public hosts, DNS, HTTPS, TLS certificates, baseline security headers, email-security records, and reachable services. Teams can review the evidence, confirm ownership, and convert important assets into continuous monitors. It is an EASM and monitoring workflow, not a penetration test or a guarantee that a system is vulnerability-free. ## What does a technical example look like? ``` Known domain: example.com | +-- DNS records and nameservers +-- Certificate transparency names +-- Public subdomains and IP addresses +-- Reachable HTTP, HTTPS, and TCP services +-- Ownership and business-context review +-- Continuous DNS, TLS, uptime, and change monitoring ``` The example uses reserved documentation domains and addresses. Apply the same reasoning to systems you own or are authorized to assess. ## Authoritative technical references - [NCSC External Attack Surface Management buyer's guide](https://www.ncsc.gov.uk/guidance/external-attack-surface-management-buyers-guide) - [RFC 9162: Certificate Transparency Version 2.0](https://www.rfc-editor.org/rfc/rfc9162.html) ## How does continuous monitoring help? A point-in-time check explains the observed state now. [Continuous monitoring](https://sentryxmonitor.com/services/uptime-monitoring/) establishes an expected baseline, repeats the relevant check, and records meaningful state changes so an owner can investigate before a small configuration drift becomes a prolonged security or availability problem. See [Learn](https://sentryxmonitor.com/learn/) for the surrounding technical context. ## Where does Sentryx Monitor fit? Sentryx Monitor provides [read-only outside-in discovery](https://sentryxmonitor.com/services/external-attack-surface-monitoring/) and monitoring for public hosts, DNS, HTTPS, TLS certificates, baseline security headers, email-security records, and selected network services. It supports evidence and operational follow-up, but it does not replace authorized penetration testing, authenticated vulnerability assessment, or owner validation. ## Continue learning - [What Is External Attack Surface Management?](https://sentryxmonitor.com/learn/external-attack-surface-management/what-is-easm/) - A clear explanation of EASM, its workflow, scope, and relationship to continuous security monitoring. - [What Is an External Attack Surface?](https://sentryxmonitor.com/learn/external-attack-surface-management/what-is-an-external-attack-surface/) - Understand which public assets make up an external attack surface and why the inventory changes over time. - [How Attackers Discover Internet-Facing Assets](https://sentryxmonitor.com/learn/external-attack-surface-management/how-attackers-discover-internet-facing-assets/) - Learn the public signals attackers use to find domains, subdomains, IP addresses, certificates, and exposed services. - [How to Find Forgotten Subdomains](https://sentryxmonitor.com/learn/external-attack-surface-management/how-to-find-forgotten-subdomains/) - A practical process for discovering, validating, and retiring forgotten public subdomains. - [What Is Shadow IT?](https://sentryxmonitor.com/learn/external-attack-surface-management/what-is-shadow-it/) - Learn how unapproved or unmanaged technology becomes part of an organization's external attack surface. - [What Is Attack Surface Discovery?](https://sentryxmonitor.com/learn/external-attack-surface-management/what-is-attack-surface-discovery/) - Understand how attack surface discovery identifies public assets and how evidence confidence should be handled. - [EASM vs Vulnerability Management](https://sentryxmonitor.com/learn/external-attack-surface-management/easm-vs-vulnerability-management/) - Compare external attack surface management with vulnerability management and see why mature programs use both. - [EASM vs Penetration Testing](https://sentryxmonitor.com/learn/external-attack-surface-management/easm-vs-penetration-testing/) - Compare continuous external asset management with time-bound penetration testing. - [EASM vs CSPM](https://sentryxmonitor.com/learn/external-attack-surface-management/easm-vs-cspm/) - Compare external attack surface management with cloud security posture management. - [How to Build an External Asset Inventory](https://sentryxmonitor.com/learn/external-attack-surface-management/external-asset-inventory/) - Build an external asset inventory that combines discovery evidence, ownership, business context, and monitoring state. - [What Are Exposed Services?](https://sentryxmonitor.com/learn/external-attack-surface-management/what-are-exposed-services/) - Learn what internet-exposed services are, when exposure is expected, and how to prioritize review. - [How Often Should You Scan Your Attack Surface?](https://sentryxmonitor.com/learn/external-attack-surface-management/attack-surface-scan-frequency/) - Choose an attack surface discovery and monitoring frequency based on change rate and business risk. ## Related - [Home](https://sentryxmonitor.com/)