Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Enterprises Are Using External Attack Surface Management
Transcript
- Lucas: Luna, I want to talk about something that's quietly become one of the hottest categories in enterprise security: External Attack Surface Management. EASM for short. Luna: I keep seeing that acronym in vendor pitches. Is it basically just a fancy name for vulnerability scanning? Lucas: That's the question everyone asks. And honestly, it's a fair one. But EASM is distinct in a couple of key ways. Traditional vulnerability scanning assumes you know what you own — you give it an IP range or a list of hosts, and it checks those for known CVEs. Lucas: EASM flips that. It starts from the outside — scanning the entire internet, really — to discover what's exposed under your organization's name. Subdomains, cloud storage buckets, expired certificates, third-party services — stuff your own IT team may have forgotten about. Luna: So it's more about asset discovery than patch management. I can see why that's appealing when shadow IT is everywhere. Lucas: Exactly. Gartner actually predicted that by 2026 — which is this year, now — 70% of organizations would have an EASM program in place. That's up from maybe 20% a few years ago. Luna: What's driving that? Is it regulatory pressure, or just more high-profile breaches from forgotten assets? Lucas: Both. But I think a specific story from 2024 really crystallized it. A Fortune 500 retailer — household name, I won't say which — had a development server sitting on AWS that was never taken down after a project ended. It had a default credential and a public IP. Lucas: A security researcher using a tool like Censys or Shodan found it, and reported it through a bug bounty program. The company had no idea it existed. That's the nightmare scenario EASM is designed to prevent. Luna: Right, because from an attacker's perspective, that's the low-hanging fruit. They don't need a zero-day if they can walk through an unlocked door. Lucas: Precisely. And the thing is, the attack surface is growing. Every time a team spins up an S3 bucket, a Lambda function, a Kubernetes cluster — that's a potential entry point. And traditional asset management databases are often incomplete. Luna: So how do these EASM tools actually work? Are they scraping the internet constantly? Lucas: Basically, yes. They use a combination of passive DNS data, SSL certificate transparency logs, search engine indexing, and active scanning. They build a map of every internet-facing asset associated with your domain. Then they prioritize based on risk — like whether something has a known vulnerability, or sensitive data exposure. Luna: And they're selling this as a service? Who are the main players? Lucas: There's a mix. CrowdStrike has Falcon Surface, which integrates with their endpoint platform. Palo Alto Networks has Cortex XSIAM with some EASM capabilities. Then there are pure-play startups like Censys and Assetnote. Microsoft also has Defender External Attack Surface Management. Luna: That's a crowded field. How do enterprises choose? Lucas: A lot depends on whether they want a standalone tool or something that feeds into their existing SIEM or SOAR. The key differentiator these days is the quality of the discovery engine — how many assets it finds that others miss — and the risk scoring accuracy. Luna: I imagine there's also a tension between automation and noise. If you're scanning the whole internet, you're going to find a lot of false positives. Lucas: That's the biggest challenge. A tool might flag a test subdomain that's been up for years with no real risk. So the leading platforms use machine learning to filter out benign findings and correlate with actual threat intelligence. Luna: Let's talk about the relationship with attack surface reduction. Is EASM just the discovery piece, and then you have to actually fix things? Lucas: Yes — EASM is discovery and monitoring. Attack surface reduction is the remediation step. But more vendors are building both into what they call Continuous Threat Exposure Management, or CTEM. That's Gartner's framework again: continuously discover, prioritize, and remediate exposures. Luna: So CTEM is the umbrella, EASM is a core component. That makes sense. And I assume these tools are also being used for merger and acquisition due diligence? Lucas: Big time. When a company acquires another, they want a full picture of the acquired company's external footprint before the deal closes. We've seen a few instances where M&A deals were almost scuttled because of exposed infrastructure found in due diligence. Luna: Speaking of acquisitions — there's been some consolidation in this space. Do you see it becoming a feature of larger platforms rather than a standalone category? Lucas: I think it'll go both ways. The pure-play vendors will survive if they stay best-in-class on discovery. But increasingly, CISOs want fewer vendors, not more. So if CrowdStrike or Palo Alto can embed EASM into their platforms, they have a natural advantage. Luna: And for a mid-market company with a lean security team, a platform approach is probably more appealing than stitching together five different tools. Lucas: Exactly. That's where we're seeing the most growth. Companies with maybe 50 to 500 employees that are just now formalizing their security program. They want something that's easy to set up and gives them a clear view of their exposure. Luna: You know, this reminds me of something I heard from a CISO at a SaaS company last month. She said that after deploying EASM, they found 40 percent more internet-facing assets than their CMDB listed. That's a huge gap. Lucas: That number doesn't surprise me. I've seen studies that say the average enterprise has three to five times more assets exposed than they think they do. Shadow IT, forgotten dev instances, acquired company leftovers — it adds up. Luna: So if I'm a security leader listening to this, what's my first step toward EASM? Lucas: Start with a free or low-cost tool. Censys has a free tier. Assetnote offers a limited free scan. Even Shodan, which is more general-purpose, can give you a quick snapshot. Run it against your primary domain and see what comes up. Lucas: Then you'll have a concrete list to bring to your executive team. 'Here are 50 exposed assets we didn't know about. Here's what we need to protect.' That's a powerful argument for funding a formal EASM program. Luna: And it's not just about finding things — it's about monitoring them continuously. Attack surfaces change every day. Lucas: Right. A developer might spin up a new EC2 instance for a prototype, and if it's not locked down, it could be in Shodan within hours. EASM gives you the visibility to catch that before an attacker does. Luna: It's almost like a digital perimeter defense for the cloud era. Before, you had a firewall and that was it. Now your perimeter is every DNS record and cloud service you've ever created. Lucas: That's a great way to put it. And if these conversations are useful for what you're building or running — if you're the one trying to keep that digital perimeter secure — we just want to say that this show is possible because of listeners who chip in a couple of dollars a month. Luna: Yeah, it's genuine. We don't run ads, we don't do sponsorships. It's just the community. A few bucks at buy me a coffee dot com slash fexingo goes a long way to keeping these episodes ad-free and focused on substance. Lucas: Exactly. No pressure at all. But if you've gotten something out of the show, that's the simplest way to support it. And now back to EASM — one more angle I want to touch on is how these tools are starting to integrate with AI for automated remediation. Luna: Oh, interesting. So instead of just alerting you, the tool can actually fix some issues automatically? Lucas: In limited cases, yes. If an S3 bucket is publicly readable and contains no sensitive data, the tool could automatically apply a private ACL. But for riskier changes, it still needs human approval. The AI reduces the toil of triaging low-severity findings. Luna: That seems like a good middle ground. Security teams are already overwhelmed with alerts. Anything that can safely take low-risk items off their plate is valuable. Lucas: Exactly. And that's where the market is heading — not just discovery, but intelligent prioritization and automated response. The endgame is a self-healing attack surface. Luna: Self-healing — that's a bold vision. How far off do you think we are? Lucas: I think within two to three years, we'll see early versions. For simple misconfigurations, it's already possible. The harder part is distinguishing between intentional exposure — like a public API — and an accidental one. That requires context that tools don't always have. Luna: So there's still a need for human judgment. That's reassuring for security professionals worried about being replaced. Lucas: Absolutely. EASM isn't about replacing people. It's about giving them the visibility they need to focus on the highest-impact work. The tools handle the grind of discovery; the humans handle the strategy. Luna: That's a good note to end on. Thanks, Lucas. Lucas: Thanks, Luna. And to our listeners — if you've got an EASM story or a tool you'd recommend, we'd love to hear about it.