What EASM is and how to get started
External Attack Surface Management (EASM) is the platform's capability for continuously discovering and monitoring your organization's external infrastructure. In practice, it works like an always-on scanner that maps everything reachable from the internet that belongs to your organization — subdomains, IPs, open ports, running services, digital certificates, and vulnerabilities — and surfaces what poses the greatest risk.
The main difference between EASM and a point-in-time security assessment is that EASM is continuous. Your attack surface changes every day: new subdomains are created, services are exposed, and certificates expire. EASM tracks those changes automatically and turns them into actionable exposures your team can prioritize and remediate.
EASM is designed for security and infrastructure teams that need full visibility into what their organization has exposed to the internet, including assets they may not be actively managing.
The first step: add your seeds
Before any discovery begins, EASM needs a starting point. That starting point is called a seed — a domain or IP address that belongs to your organization. From a single seed, EASM automatically discovers related subdomains, IP addresses, digital certificates, and exposed services.
Without at least one seed registered, the Assets view will show no data, and discovery cannot run. To add a seed, go to:
Then click + Add seed and enter one or more domains, IPv4, IPv6, CIDR (/16–/32), or IP ranges. To add multiple seeds at once, separate them with a semicolon (;). Seeds are automatically added to the safelist.
📝 You can also add an optional description to help identify a group of seeds later.
What a seed is and why it matters
A seed is the starting point for discovery. It can be a primary domain (example.com), an IP address, or a CIDR range owned by your organization. From there, EASM expands outward: it finds related subdomains through WHOIS relationships, maps the IPs behind them, identifies running services, and enumerates exposed ports and certificates.
The quality of your seed list directly affects the coverage of your attack surface map. A single domain like example.com can result in hundreds of discovered assets. Adding multiple seeds across business units, subsidiaries, or IP ranges gives a more complete view.
Related Discovery: how EASM expands from your seeds
When you add a seed, EASM looks for other assets connected to it through WHOIS ownership data, specifically, domains or IPs registered under the same organization. This is called Related Discovery.
For each newly discovered related asset, you decide how it is handled:
Whois Owner — Assets from the same registrant organization are suggested for monitoring.
Add as pending — Newly discovered assets require your manual review before being added to monitoring.
Auto-approve — Newly discovered assets are automatically approved and added to monitoring without manual review.
📝 Start with Add as pending if you want to review what EASM finds before it enters your active monitoring. Switch to Auto-approve once you trust the discovery scope for a given seed.
Monitoring setup: defining what EASM monitors
When adding a seed, you also configure which aspects of your infrastructure EASM should monitor. This is the Monitoring setup section in the Add Seed flow.
The main monitoring category is External Attack Surface Management (EASM), which controls infrastructure exposure monitoring for the specified domain. Within it, you can enable:
Infrastructure exposure monitoring — Detects exposure from the specified domain, including subdomains, related IPs, digital certificates, running services, and associated vulnerabilities.
Inferred CVEs — Includes CVEs inferred based on observed signals and correlations.
Port Alerting Scope — Configures which open port events trigger alerts.
DNS Hygiene — Monitors for DNS misconfigurations.
Expiring Domain Configuration — Alerts on domains approaching expiration.
Expiring Certificate Configuration — Alerts on TLS certificates approaching expiration.
📝 Enable only what makes sense for your environment. Each item you enable becomes a problem category EASM will monitor, when something is detected, an exposure is automatically created as a ticket for your team to address.
Monitoring frequency
EASM runs two distinct automated processes, each on its own schedule:
Asset discovery — Scans your seeds and finds new assets (subdomains, IPs, services) within a few hours of each run.
Exposure monitoring — Scans already-discovered assets for vulnerabilities and exposures. This cycle runs every 24 hours.
This means that when you add a new seed, you can expect to see discovered assets appear in the Assets view within hours. New exposures on those assets will then be evaluated in the next monitoring cycle.
📝 You can also trigger both processes manually at any time using the Discover Now and Scan Now buttons in the top right of the Assets view.
Understanding the Assets view
Once seeds are registered and discovery begins, the Assets view becomes your primary window into your organization's external infrastructure. You can access it at:
What the Assets view shows
The top of the Assets view shows five summary counters:
Seeds — The root domains or IPs you registered as starting points.
Hosts — Subdomains and hostnames discovered from your seeds.
Subdomains — Subdomains identified during discovery.
IPs — IP addresses associated with your infrastructure.
Vulnerabilities — Total vulnerabilities detected across your assets.
Below the counters, a data table lists every discovered asset with key attributes: asset name, IP address, highest risk score, type (A, AAAA, CNAME, etc.), number of exposures, tags, seed it was discovered from, monitoring status, when it was added, and last scan date.
Risk score on assets
Each asset in the table has a Highest Risk Score badge. This score is derived from the vulnerabilities detected on that asset: the highest CVSS score among all associated CVEs determines the asset's risk score. If no CVEs are associated with an asset, its risk score is not defined.
The color of the badge signals priority:
Red — Critical (9.0–10.0)
Orange — High (7.0–8.9)
Yellow — Medium (4.0–6.9)
Gray — Low or no score
Use the risk score column to sort your asset list and focus remediation on the highest-risk items first.
Filtering the asset table
The Assets view includes multiple filters to help you focus on a specific subset of your attack surface:
Search — Free-text search by asset name or host.
First seen at — Filter by when the asset was first discovered.
Business impact — Filter by how critical the asset is to your business.
Status — Online, offline, or other monitoring states.
Open ports — Filter assets by detected open port numbers.
Cloud — Filter by cloud provider associated with the asset.
Technologies — Filter by technologies detected on the asset.
Tags — Filter by custom tags applied to the asset.
DNS type — Filter by DNS record type (A, AAAA, CNAME, etc.).
📝 Use Reset filters to clear all active filters and return to the full asset list.
Asset management button
The Asset management button in the top-right of the Assets view is a shortcut back to Monitoring Settings. Use it to add new seeds, edit existing seeds, or adjust monitoring configuration without leaving the EASM context.
Discover Now and Scan Now
Two action buttons appear in the top-right of the Assets view:
Discover Now — Triggers a new discovery run from your seeds to find recently created or changed assets.
Scan Now — Triggers a new vulnerability and exposure scan across your already-discovered assets.
The last full discovery timestamp is shown next to these buttons so you know when data was last refreshed.
Understanding the Exposures view
Exposures are issues found on your assets. While the Assets view shows your infrastructure inventory, the Exposures view is where you act. You can access it at:
What an exposure is
An exposure is a detected problem on a specific asset: a vulnerability (CVE), an open port that should not be public, an expiring certificate, a DNS misconfiguration, or another issue defined in your monitoring setup. Each exposure includes a technical description, a business impact level, and concrete evidence showing where it was detected.
The Risk Matrix
The Risk Matrix is the primary prioritization tool in the Exposures view. It maps exposures across two axes:
Business Impact (vertical axis) — How critical the affected asset is to your business: Trivial, Easy, Moderate, Difficult.
Exploit Feasibility (horizontal axis) — How easy it is for an attacker to exploit the issue: Low, Medium, High, Critical.
Each cell in the matrix shows the number of exposures at that combination. Cells are color-coded: red cells indicate high feasibility and high business impact — these are the exposures to address first.
The Risk Matrix is interactive. Click any cell to filter the exposure list below to only that risk combination. Start with the red cells: they are the most critical and the easiest to exploit.
📝 The upper-right corner (Critical × Easy) is where you act first. Those exposures are both highly exploitable and affect your most critical assets.
New exposures trend
The Exposures view also shows a trend chart of new exposures over time, with a count of new exposures this week. This helps you understand whether your attack surface is growing, shrinking, or stable, and whether recent infrastructure changes have introduced new risks.
Assigned to me
The "Assigned to me" counter shows how many exposures are currently assigned to you across all severity levels: Critical, High, Medium, Low, and Awaiting. Use this to quickly find your personal workqueue without filtering the full table.
Filtering exposures
The exposures table can be filtered by:
Search — Free-text search by exposure name.
First seen at — Filter by when the exposure was first detected.
Hostnames — Filter by the hostname where the exposure was found.
IP addresses — Filter by the IP address associated with the exposure.
Type — Filter by exposure category (Vulnerabilities, DNS Hygiene, Certificates, etc.).
Risk score — Filter by CVSS severity range.
Feasibility — Filter by exploit feasibility level (Low, Medium, High, Critical).
Assign status — Filter by whether the exposure has been assigned.
Assigned to — Filter by the team member responsible for remediation.
Tags — Filter by custom tags applied to exposures.
Business impact — Filter by how critical the affected asset is to your business.
What each exposure reveals
Each exposure in the table includes:
Name — The CVE identifier, misconfiguration name, or issue type.
Assets — The asset(s) where the issue was found, with a count if multiple.
Risk score — Derived from the highest associated CVSS.
Business impact — How critical the affected asset is.
Exploit Feasibility — How achievable exploitation is.
Status — Current remediation status.
Type — Category of exposure (Vulnerabilities, DNS Hygiene, etc.).
Age — How long this exposure has been open.
Assigned to — Team member responsible for remediation.
Tags — Labels for filtering and organization.
First seen / Last seen — When the exposure was first detected and most recently confirmed.
How EASM measures risk
EASM prioritizes findings through a risk matrix built on two core dimensions:
Business Impact: how critical an asset is to the organization
Exploit Feasibility: how easily a finding could be exploited by an attacker
Together, these dimensions help teams focus first on the exposures that are both more relevant to the business and more likely to be used in a real attack scenario.
Classification ranges
Exploit Feasibility
Difficult: 0-39
Moderate: 40-69
Easy: 70-89
Trivial: 90-100
Business Impact
Low: 0-39
Medium: 40-69
High: 70-89
Critical: 90-100
CVSS severity reference
Low: 0.0-3.9
Medium: 4.0-6.9
High: 7.0-8.9
Critical: 9.0-10.0
This model goes beyond vulnerability severity alone. In addition to signals such as CVSS, EPSS, and known public exploits, EASM also considers contextual asset attributes, including naming patterns, production relevance, brand similarity, and DNS traffic indicators, to generate more meaningful prioritization.
The result is a more actionable risk view, helping customers identify which exposures require the most urgent response.
Notification settings for new exposures
By default, exposure notifications are disabled. To receive alerts, you must enable them manually in your notification preferences:
In the notifications settings, you can enable or disable the Exposure alerts toggle. This is a single toggle that controls all exposure-related email notifications. When enabled, you receive alerts for:
New high or critical findings detected on your monitored assets.
Risk score escalated to high or critical on an existing asset.
Exposures assigned to you.
📝 In this initial phase, only Exposure alerts are available as a notification type. More granular notification options may be introduced in the future.
Key concepts glossary
Term | Definition |
Seed | A domain or IP address you register as the starting point for EASM discovery. EASM expands from seeds to find related infrastructure. |
Asset | Any host, subdomain, IP address, or network range discovered from your seeds is now part of your monitored attack surface. |
Exposure | A detected issue on an asset: a vulnerability, misconfiguration, expiring certificate, or other problem category enabled in your monitoring setup. |
Risk Score | The highest CVSS score among all CVEs associated with an asset or exposure. Used to help you prioritize remediation. |
Exploit Feasibility | How achievable it would be for an attacker to exploit a specific exposure classified as Low, Medium, High, or Critical. |
Business Impact | How critical the affected asset is to your organization. Used alongside Exploit Feasibility in the Risk Matrix. |
Risk Matrix | A 4×4 grid mapping Business Impact against Exploit Feasibility. Interactive: click any cell to filter exposures to that combination. |
Discovery | The process of automatically finding assets related to your seeds through WHOIS, DNS, and other signals. |
Related Discovery | The mechanism that finds assets owned by the same organization as your seed, based on registrant data. |
CVE | Common Vulnerabilities and Exposures. A standardized identifier for a known security vulnerability. |
CVSS | Common Vulnerability Scoring System. A 0–10 scale measuring the technical severity of a vulnerability. |
Infrastructure Exposure Monitoring | The core EASM monitoring type detects subdomains, IPs, certificates, services, and vulnerabilities from your seeds. |
Quick-start checklist
Follow these steps to go from zero to a fully active EASM monitoring setup:
Step 1 — Go to Monitoring Settings → Asset management → Infrastructure and click + Add seed.
Step 2 — Enter your primary domain (e.g., example.com) and click Save seed.
Step 3 — Configure Related Discovery: choose Add as pending to review new assets before they enter monitoring.
If you choose Add as pending, return to Monitoring Settings → Asset management → Infrastructure to review discovered assets and activate their monitoring manually.
Step 4 — Enable Infrastructure exposure monitoring under the Monitoring setup section.
Step 5 — Wait for the initial discovery to complete (a few minutes for small environments, longer for large ones).
Step 6 — Go to Infrastructure Exposure → Assets to review discovered assets and their risk scores.
Step 7 — Click the Exposures tab and open the Risk Matrix. Start with the red cells.
Step 8 — Enable email notifications in User Preferences so new exposures reach you automatically.
📝 You can add more seeds at any time. Each new seed expands your attack surface coverage.
If you have any questions, feel free to reach out at [email protected] 😊