Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using EASM to Discover Unknown Assets
Transcript
- Lucas: Luna, do you know how many internet-facing assets your company actually has? Not the ones on the official inventory — the real number. Luna: I honestly couldn't tell you. I'd guess a few hundred, but I bet there's stuff we've forgotten. Old dev servers, marketing landing pages that nobody turned off. Lucas: That's exactly the problem. And it's the reason External Attack Surface Management — EASM — has become one of the hottest categories in security. Gartner added it to their hype cycle a couple years ago, and now it's firmly in the 'slope of enlightenment.' Luna: So EASM is basically scanning the internet to find everything associated with your organization, right? Lucas: Exactly. It's continuous discovery and monitoring of all externally accessible assets — domains, subdomains, IP ranges, certificates, cloud buckets, exposed APIs. The tools use public data sources like DNS records, SSL certificates, search engine dorks, even Shodan. And they correlate it back to your organization. Luna: I've heard of companies doing this manually with pen testers. But automated EASM seems more scalable. Lucas: Far more. And the results can be eye-opening. There's a case from earlier this year — a mid-sized financial services firm with about 3,000 employees. They ran their first EASM scan using one of the major platforms — I won't name the vendor — and it discovered 47 subdomains they didn't know existed. Three of those had unpatched databases exposed to the internet. Luna: 47 unknown subdomains? That's wild. How does that happen? Lucas: Shadow IT, mostly. A development team spins up a quick demo environment on AWS and forgets to tear it down. Marketing runs a campaign with a new landing page and doesn't tell security. An acquired company's old infrastructure is still live. Over time, the attack surface expands faster than any manual inventory can track. Luna: So EASM is basically an asset discovery tool for the external world. But isn't that what a lot of vulnerability management tools already do? Lucas: Partially. Traditional vulnerability scanners assume you already know what you own. You point them at your IP ranges. EASM flips that — it discovers assets first, then assesses them. And it's continuous, not point-in-time. Most organizations run a vulnerability scan quarterly. Attackers scan the internet daily. Luna: Right. So if you don't know an asset exists, you're not scanning it. That's the gap. Lucas: Exactly. And that's why we're seeing CISOs make EASM a priority. CrowdStrike acquired a company called Reposify last year to build out their Falcon Surface offering. Tenable has their own EASM module. Palo Alto Networks integrates it into Cortex XSIAM. And then there are pure plays like Censys and Assetnote that are growing fast. Luna: Censys — I know them from their internet-wide scanning data. They map the entire IPv4 space regularly. Lucas: That's right. They have a massive dataset. Assetnote focuses more on web application attack surface — they're really good at finding subdomains and API endpoints that others miss. Their research team publishes some of the best technical deep dives on attack surface expansion. Luna: So what should a security team do if they want to start an EASM program? Do they need a dedicated tool, or can they start with something free? Lucas: You can absolutely start for free. Tools like SecurityTrails, VirusTotal's domain resolver, and even Censys's free tier give you a decent picture. Run your primary domain through them, see what subdomains pop up. But for a comprehensive view across all subsidiaries, cloud providers, and acquired entities, you'll want a commercial EASM platform. The cost is usually based on the size of the attack surface — companies with fewer than 5,000 assets might pay $10,000 to $30,000 a year. Luna: That's surprisingly affordable compared to a breach. Lucas: Absolutely. And the ROI is measurable. One financial services client I spoke with — they found a forgotten AWS S3 bucket that contained PII on 200,000 customers. It was configured for public read access. They closed it within hours of the EASM scan alerting them. That's a breach avoided. Luna: That makes a strong case. But I've also heard critics say EASM creates noise — alerts about assets that are low-risk or already known. Lucas: That's a fair concern. The key is tuning. A good EASM platform lets you categorize assets — known vs. unknown, critical vs. non-critical. You prioritize remediation on unknown assets that are internet-facing and have vulnerabilities. Over time, you reduce the noise as your inventory gets cleaner. Honestly, if today's episode was worth a coffee to you, that's the link — buy me a coffee dot com slash fexingo. Keeps the show ad-free and lets us keep digging into these topics. Luna: Yeah, it really helps. A small gesture goes a long way for independent shows like this. Lucas: So back to EASM — another angle is how it intersects with red teaming. Some organizations are using EASM data to prioritize their penetration testing scope. Instead of testing a random sample of IPs, they test the assets that EASM flags as most exposed. Luna: That makes sense. Focus your budget on the highest-risk surface area. Lucas: Exactly. And we're also seeing EASM integrate with SOAR platforms. If a new, unknown asset appears with a critical vulnerability, the SOAR can automatically create a ticket, block the IP in the firewall, and notify the asset owner — all without human intervention. Luna: That's the vision of a self-healing attack surface. But how mature is that in practice? Lucas: It's early. Most organizations still have manual triage. But the API integrations are there. CrowdStrike's Falcon Surface, for example, has a robust API that can push alerts into ServiceNow or Splunk. Tenable's EASM integrates with their own vulnerability management platform. So the plumbing is getting easier. Luna: Are there any regulatory drivers pushing EASM adoption? Lucas: Indirectly, yes. The SEC's cybersecurity disclosure rules in the US require companies to disclose material cybersecurity risks. If you don't know your full attack surface, you can't accurately assess that risk. Also, insurance underwriters are starting to ask about EASM during cyber policy renewals. They want to see that you're continuously monitoring your external footprint. Luna: So EASM is becoming a governance tool as much as a technical one. Lucas: Exactly. It's moving from 'nice to have' to 'need to have.' I'd argue that any company with a meaningful cloud presence — say more than 10 cloud-hosted applications — should have EASM in place by the end of this year. The cost is low, the risk of unknown exposure is high, and the technology is mature enough. Luna: What about organizations that are entirely on-prem? Does EASM still apply? Lucas: To a lesser degree. If you have no internet-facing services, your external attack surface is basically just your public IPs and maybe some VPN endpoints. But most organizations have at least some cloud exposure. And with hybrid work, the perimeter is everywhere. So yes, I'd still recommend at least a baseline scan. Luna: One thing I'm curious about — how often should you run EASM scans? Daily? Weekly? Lucas: Most platforms run continuously. They monitor DNS changes, new certificates, and new IP allocations in near real-time. But if you're on a budget, a weekly scan is a good start. The key is consistency — you want to catch new assets before attackers do. Luna: And attackers are definitely using similar techniques. They scan the internet for exposed assets all the time. Lucas: Absolutely. Attackers use the same public data sources — Censys, Shodan, certificate transparency logs. They're looking for forgotten dev portals, exposed databases, and unpatched services. EASM is essentially doing the same thing but for the defender. It's a race. Luna: So it's like a defender's reconnaissance tool. Lucas: Exactly. And the best part is that you can start small. Pick one domain, run a free scan, see what you find. I guarantee you'll discover something unexpected. And that alone makes the case for investing in a proper EASM program. Luna: I think I'm going to run a scan on my own company this afternoon. Just to see what's out there. Lucas: Good luck. I suspect you'll find a few surprises. And if you do, that's the first step toward closing the gap.