Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Security Teams Are Using EASM to Find Hidden Assets
Transcript
- Lucas: If these conversations are useful for what you're building or running, we want to keep them coming. And the way this stays ad-free is listener support — buy me a coffee dot com slash fexingo. Luna: Yeah, it's a small way to keep the show independent. We're grateful to everyone who chips in. Lucas: Alright — let's talk about something most security teams are still not doing well enough: knowing what they actually own on the internet. Luna: You mean External Attack Surface Management. EASM. Lucas: Exactly. It's the category that's been quietly heating up over the past 18 months. Gartner put EASM on its emerging tech radar last year, and now you're seeing the big security vendors move fast to acquire EASM startups. Luna: CrowdStrike bought Bionic in early 2025 for what, around $350 million? And Tenable acquired Ermetic the year before. Lucas: Right. And those are just the public deals. The core idea is simple but surprisingly hard to execute: you have to discover every internet-facing asset your organization owns — every domain, subdomain, cloud instance, API endpoint, even third-party SaaS apps — and then continuously monitor them for risk. Luna: The hard part is the 'continuously' bit. Most companies do a one-time discovery when they deploy a tool, then it goes stale inside three months. Lucas: That's the problem. And it's worse than most people realize. A study from a firm called Censys — they do internet-wide scanning — found that the average enterprise has about 30 percent more external assets than their security team has in their inventory. Luna: Thirty percent. That's a lot of blind spots. Lucas: It's the gap that attackers are actively exploiting. And the reason for that gap is organizational complexity. You've got mergers and acquisitions, shadow IT where a developer spins up a cloud instance without telling anyone, legacy systems that nobody remembers. Luna: One of my favorite examples is the retailer that acquired a smaller brand and inherited thousands of subdomains and cloud buckets that no one ever decommissioned. That's a goldmine for an attacker. Lucas: That's exactly the case I was going to mention. It was a Fortune 500 company in the retail space. After the acquisition, their security team was aware of maybe 200 subdomains from the acquired brand. EASM discovery turned up over 1,800. Some were running outdated content management systems with known vulnerabilities. Luna: So the EASM tool essentially did a continuous internet scan using public data sources — DNS records, SSL certificates, search engine indexes — to build a map of everything pointing back to the company. Lucas: Exactly. It's non-intrusive. The tool doesn't log into any systems; it just observes from the outside, the same way an attacker would. And that's actually a design philosophy that matters. Luna: Right, because if you're scanning from the inside, you're limited to what you already know. EASM is about seeing yourself as the internet sees you. Lucas: That phrase should be on a t-shirt. 'See yourself as the internet sees you.' Because the reality is, attackers are doing this all the time. They have their own automated discovery tools. The gap is that defenders often don't. Luna: So what happens when a company deploys a proper EASM solution? Walk me through the workflow. Lucas: First, you define your 'seed' — your known domains, your IP ranges, your ASN. The tool then crawls outward, discovering all associated domains and subdomains, and it checks for open ports, services, SSL certs, and so on. Luna: And it flags anything that looks risky — an expired SSL cert, a service running on a non-standard port, a subdomain that resolves to an IP in a different cloud provider. Lucas: Yes. Then the team triages those findings. The key is not to overwhelm them. A good EASM platform prioritizes by exploitability and business context. If a forgotten dev server has a remote code execution vulnerability and it's internet-facing, that goes to the top of the queue. Luna: And the remediation can be anything from patching to taking the asset offline entirely. Lucas: Or, in some cases, just acknowledging it exists and accepting the risk. But the point is, you can't manage what you can't see. EASM closes that visibility gap. Luna: Let me play devil's advocate for a second. Some security professionals argue that EASM tools themselves create a new risk — they're scanning the internet on your behalf, and if someone compromises the EASM vendor, they could use that scanning infrastructure to map your entire attack surface. Lucas: It's a valid concern. But the major vendors treat their scanning infrastructure as a critical asset — they isolate it, monitor it heavily. And the alternative is doing nothing, which is far riskier. It's a question of relative risk. Luna: Fair. And most CISOs I talk to say the visibility benefits far outweigh the vendor risk, especially if you choose a platform with strong security credentials. Lucas: The broader trend here is that security is moving from a 'patch and pray' model to a 'continuous discovery and response' model. EASM is a foundational piece of that. You can't respond to a threat you don't know about. Luna: And it's not just for the Fortune 500 anymore. Mid-market companies are starting to adopt EASM too, often through managed security service providers. Lucas: Because the attack surface doesn't care about your company size. If you have an internet-facing asset, it's discoverable. The question is whether you discover it first or an attacker does. Luna: Let's talk about the market. Who are the key players beyond CrowdStrike and Tenable? Lucas: You've got dedicated EASM companies like Censys, Expanse, and Randori, now part of Akamai. There's also newer entrants like Detectify and Upguard that focus more on the web application layer. Luna: And they're all competing on coverage breadth and speed of discovery. Some claim to find new assets within hours of them going live. Lucas: That's the benchmark now. If you're not finding assets within 24 hours, you're too slow. Attackers can weaponize a new subdomain in minutes. Luna: So what's the one takeaway for our listeners? If they're a CISO or security manager, what should they do next week? Lucas: Run a free external scan. Most EASM vendors offer a limited free tier or a one-time scan. Pick one, point it at your main domain, and see how many assets it finds that you didn't know about. The shock value alone is usually enough to get budget approval. Luna: And from there, you can build a case for continuous monitoring. Because one scan is a snapshot. The real value is in the ongoing discovery. Lucas: Exactly. Think of it like a smoke detector — you don't install it once and assume it works forever. You test it, you replace batteries, you keep it running. EASM is the same. Luna: Good analogy. Alright, I think we've given people a solid angle to start with. Thanks, Lucas. Lucas: Thanks, Luna. And to our listeners — if this episode changed how you think about your attack surface, consider supporting the show at buy me a coffee dot com slash fexingo. It keeps us ad-free and independent. See you next time.