APPROACH · EASM

What is external attack surface management (EASM)? The outside-in view

SHORT ANSWER

External attack surface management (EASM) looks at your organisation from the internet, the way an attacker would, to find the domains, IP addresses, certificates and services you expose, including ones nobody listed. It works from the outside in, where CAASM works from the inside out through the tools you run. It fits when unlisted internet-facing systems are a real concern, and it is often paired with an internal inventory rather than chosen instead of one.

By The Inventory Desk · CAASM Finder · Published 2026-10-11

Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.

How does external attack surface management work?

An EASM tool starts from seeds, such as a domain, an IP range or a company name, and works outward: related domains, certificates, IP blocks, cloud services and what runs on them. Some vendors also draw on their own scans of the whole internet or a prebuilt map of assets.

Each discovered asset needs attribution: is this really yours, or a former subsidiary, a reseller or someone else entirely? Tools show confidence or states for doubtful matches so a person can confirm them.

The output is a list of internet-facing assets and the exposures on them, which can then be added to the internal inventory, the CMDB or a ticketing tool.

When does it fit?

Teams can launch internet-facing services without central review.
You have acquisitions, brands or old projects whose domains and IP ranges nobody tracks.
You need to show what you expose to the internet to a board, a regulator or a customer.
Your internal inventory is good, but it only covers what your tools already know about.

Where does it stop?

EASM sees only what faces the internet. Laptops, internal servers, SaaS accounts and identities are outside its view, and so is whether an exposed system has an EDR agent or an owner in the CMDB. Pair EASM with an internal inventory, through CAASM aggregation or your own collection, so that each external finding can be tied to an asset record and an owner. Censys, for example, names Axonius and ServiceNow CMDB among its integrations.

Which finder answers point to EASM?

+5 if internet-facing systems nobody has listed (Where do your assets live?)
+1 if rapid7 (What do you already run?)
+2 if microsoft (Azure, Intune, Entra ID or Sentinel) (What do you already run?)

Try the finder

Which vendors describe EASM?

4 of 10 vendors describe external attack surface management on the pages we read, 1 with a condition, and 5 are not in our sources.

Vendors in alphabetical order, from their own pages.
Vendor	Status	What their pages say	Source
Armis Centrix	Not in our sources	Not described on the pages we read.	None
Axonius	Not in our sources	Not described on the pages we read.	None
Censys ASM	Described	First-party scanning across all 65K ports finds services on nonstandard ports, starting from seeds you supply.	Source: Censys external exposure management · Read 27 Sep 2026
JupiterOne	Not in our sources	Not described on the pages we read.	None
Lansweeper	Not in our sources	Not described on the pages we read.	None
Microsoft Defender EASM	Described	A prebuilt inventory for many organisations plus recursive discovery from seeds you supply.	Source: Microsoft Learn: what is discovery · Read 27 Sep 2026
Qualys CSAM	With a condition	The product page links to Qualys EASM; we did not read that page.	Source: Qualys Cybersecurity Asset Management · Read 11 Oct 2026
Rapid7 Surface Command	Described	Internal and external attack surface visibility (EASM), including unknown internet-facing assets and shadow IT.	Source: Rapid7 Surface Command · Read 27 Sep 2026
runZero	Not in our sources	Not described on the pages we read.	None
Tenable One	Described	Identifies domains related to your inventory from a map of 5 billion+ assets with 200+ metadata fields.	Source: Tenable Attack Surface Management · Read 27 Sep 2026

Not in our sources is not a no. Ask the vendor, and send us a public source if one exists.

What should you ask a vendor?

What is the least information you need to start: a domain, a list of seeds or a company name?
How do you show why an asset was attributed to us?
How often is the external inventory refreshed?
Which of our internal tools can receive external findings: CMDB, ticketing, SIEM or an aggregation platform?

Questions people ask

What is the difference between EASM and CAASM?

EASM looks from the internet inward to find exposed assets. CAASM looks from the inside, through the tools you already run. Rapid7 Surface Command describes both in one product; other vendors here describe one or the other.

Is EASM the same as ASM?

Attack surface management (ASM) is the wider term. EASM is its external part. CAASM is sometimes described as the internal part.

Can I try EASM without a sales call?

Microsoft Defender EASM offers a 30-day free trial billed through Azure afterwards, and Censys offers a free platform account, though its ASM product is sold through sales.