Key takeaway
For each discovered asset, record its owner, evidence source, internet exposure and next review date. Confirm authorization before testing a third-party system.
What external attack surface management covers
EASM discovers and tracks risks in internet-visible websites, servers, domains, APIs, cloud services and other assets. It complements internal inventory with an outside-in view. Include shadow IT and third-party services, establishing ownership and business role; a discovered address is a candidate requiring verification, not automatic proof of organizational ownership.
Discover known and unknown assets
Investigate domains, DNS, IP and IPv6 addresses, certificates, subdomains, exposed services and public-repository clues. Network equipment, IoT and cloud resources belong in this view when externally visible. Reconcile candidates with IT, network, DevOps, security and marketing owners. Repeat discovery to track new, changed and retired assets, including services absent from the maintained inventory.
Assess exposure with verified authorization
After verifying ownership and assessment authorization, evaluate versions, exposed ports, web weaknesses, cloud misconfigurations and leaked credentials. Validate automated results manually and resolve false positives. Safe confirmation must account for service impact and third-party boundaries. Link each finding to a verified asset and evidence, keeping discovery separate from permission to perform intrusive tests.
Monitor threats and business context
Monitor asset changes, new exposure and exploitation information. Critical services, data and existing controls change priority. Record supplier and supply-chain relationships with escalation paths to dependency owners. Send alerts to SIEM and ticket workflows with context explaining urgency. Threat monitoring connects discoveries to actionable decisions rather than generating another isolated list of external addresses.
Remediate and reduce the external surface
Assign owners to close exposed ports, update software, correct permissions, rotate leaked credentials or retire unnecessary services. Set deadlines by risk and business impact. Check dependencies, repeat the external assessment after changes and retain closure evidence. If exposure recurs, correct the provisioning or ownership process as well as the individual asset.
Shared reporting and tool selection
Show technical teams assets and evidence, and leadership business risk and overdue work. Evaluate discovery, fingerprints, vulnerability validation, change monitoring and workflow integration when selecting tools. Outside-in discovery and repository-secret exposure address different questions. Demonstrate actual coverage and integration so security, executives, legal and compliance teams can work from a shared, verified view.
Product examples: discovery and exposed secrets
IBM Randori Recon helps discover externally visible assets and services; evaluate this approach for resources absent from internal lists. GitGuardian Public Monitoring monitors secret exposure in public GitHub commits linked through the configured organizational perimeter. Validate sources and actual coverage rather than assuming continuous coverage of every public object or secret. For leaked credentials, check use and dependencies, revoke and replace them, update dependent services and route work to the repository owner. Deleting a file does not revoke a secret. These capabilities address different exposure types.
Example: from discovery to verified closure
If an old public API is discovered, work through this closure process. Confirm ownership and authority first.
Verify ownership and dependencies
Confirm domain and cloud-account ownership, service owner, data and dependent applications to avoid changing the wrong service.
Authorize assessment
Authorize scope and methods and validate actual exposure; discovery alone does not grant authority to intervene.
Have the owner approve change
Have the owner approve update or retirement and associated DNS and network changes, accounting for dependencies and rollback.
Verify closure
Repeat the external check, confirm dependent service operation and update inventory and provisioning templates to prevent unintended re-exposure.