Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using External Attack Surface Management
Transcript
- Lucas: If these conversations are useful for what you're building or running, I want to start with something that came across my desk this morning. Gartner published an updated forecast for the external attack surface management market — EASM — and they're predicting it will hit one point two billion dollars by the end of this year. That's up from about eight hundred million in 2024. Luna: That's a fifty percent jump in two years. What's driving that? Lucas: And by the way, if today's episode is useful to you — and I hope it is — the way these stay ad-free is listener support. You can buy us a coffee at buy me a coffee dot com slash fexingo. Really helps keep the conversation going without sponsored interruptions. Luna: Absolutely. It's a small thing that makes a big difference for us. Okay, back to the attack surface — what's fueling that growth? Lucas: Right. So the big driver is that companies are realizing they don't actually know everything they have connected to the internet. I'm talking about dev servers, expired subdomains, cloud storage buckets left open — assets IT forgot about but attackers can find in minutes. Luna: I've heard the statistic that forty percent of assets in a typical enterprise are unknown to the security team. Is that still accurate? Lucas: It might even be conservative. There was a case last year — a Fortune 500 retailer — they ran their first EASM scan and found forty-seven exposed cloud storage buckets. Some of them contained customer order data. They had no idea those buckets existed. Luna: Forty-seven. That's not a handful. That's a systemic gap. Lucas: Exactly. And that's the core value proposition of EASM. It sits outside your network and maps your attack surface from an attacker's perspective. It uses internet-wide scanning, certificate transparency logs, DNS records — things like that — to discover IP ranges, domains, cloud APIs you didn't register centrally. Luna: So it's not just another vulnerability scanner. It's a discovery engine first. Lucas: Exactly. Traditional vulnerability management assumes you already have an asset inventory. EASM doesn't make that assumption. It finds the stuff you never put on the list. And once it finds something, it checks for common misconfigurations, open ports, expired certificates — basically a triage of what an attacker would see. Luna: I imagine this is especially relevant for companies that went through rapid cloud migration during the pandemic. Shadow IT exploded. Lucas: Massively. I spoke with a CISO at a mid-sized fintech last month. He told me their dev team had spun up over two hundred AWS EC2 instances for a hackathon that never got shut down. EASM found them six months later. None of them were in their CMDB. Luna: Hackathon instances running in production environment — that's a compliance nightmare. Lucas: It is. And it's not just cloud. Think about acquisitions. When Company A buys Company B, they inherit their entire internet-facing footprint. EASM gives you a clean inventory of what you just acquired. Luna: The Gartner forecast mentions one point two billion. That's not huge compared to the overall security market, but it's growing fast. Who are the main vendors in this space? Lucas: You've got a mix. CrowdStrike has their Falcon Surface product. Palo Alto Networks has Cortex XSIAM and they also acquired Cider Security which had EASM capabilities. There are pure plays like Censys, which does internet-wide scanning, and RiskIQ — before Microsoft acquired it — was one of the early leaders. Also Axonius, which focuses on asset inventory and can feed data into EASM tools. Luna: And then there's the open-source side. Shodan, right? It's not exactly EASM, but it gives you a similar view. Lucas: Shodan is useful for reconnaissance, but it's not a managed service. EASM platforms deliver continuous monitoring, alerting, and integration with ticketing systems. The open-source tools can get you started, but for a large enterprise, you need something that scales. Luna: What about the overlap with vulnerability management? Do you still need a Qualys or a Tenable if you have EASM? Lucas: I think they're complementary. EASM finds the assets; vulnerability management scans them for CVEs. Some EASM tools do basic vulnerability checks — like checking for known CVEs on exposed services — but they're not a replacement for deep internal scanning. The real win is that EASM closes the discovery gap. Once you know an asset exists, you can run your standard VM scanner against it. Luna: So it's more about completeness of coverage than depth of analysis. Lucas: Exactly. And the business case is pretty straightforward. One of the top things insurers ask about now is 'Do you have EASM in place?' I've talked to cyber insurance brokers who say they're starting to discount premiums for companies that run continuous external scanning. Luna: That makes sense. If you can prove you know your attack surface, you're a lower risk. And it's verifiable — the insurer can run their own scan to check. Lucas: Right. And this isn't just for big companies. I've seen managed security service providers offering EASM as a bolt-on for small and medium businesses. For a few hundred dollars a month, you get a dashboard that shows all your exposed assets and alerts on changes. Luna: That's interesting. For an SMB, that could be the difference between getting insurance or not. Lucas: Absolutely. And the threat landscape is only getting more aggressive. Attackers are automating reconnaissance — they scan the entire IPv4 space every few hours. If you have a new open port, they'll find it before your next quarterly scan. Luna: So EASM is essentially defensive reconnaissance. You're doing what the attacker does, but to protect yourself. Lucas: That's a great way to put it. And the best EASM tools don't just give you a list of assets — they prioritize. They'll flag an S3 bucket with public read access over a forgotten blog subdomain that's just a parked page. Luna: Prioritization is key. I remember a breach a couple years ago where a company had a development server with customer data exposed on a subdomain that had an outdated SSL certificate. The attacker found it through certificate transparency logs. Lucas: That's exactly the kind of thing EASM catches. Certificate transparency logs are public — anyone can monitor them. EASM tools ingest those logs and alert if a new certificate is issued for your domain that wasn't approved. Luna: So it's not just about external IPs. It's about your digital footprint — domains, certificates, cloud accounts. Lucas: Right. And increasingly, EASM is integrating with identity management. Some platforms can flag if an API key is exposed on a public GitHub repo or if a cloud console is open to the internet. That's the next frontier — combining asset discovery with exposure management. Luna: Exposure management — that's the term Gartner uses. CTEM, continuous threat exposure management. EASM is one piece of that. Lucas: Exactly. We did an episode on CTEM a while back. EASM feeds into that cycle. You discover, you prioritize, you remediate. And the loop keeps turning. Luna: So if I'm a CISO listening — what's the first step? Buy an EASM tool and run a scan? Lucas: First, do a manual audit of what you think your attack surface is. List your domains, your cloud accounts, your known IP ranges. Then run an EASM scan and compare. The gap will be eye-opening. That's the business case for the budget. Luna: And if the tool finds something critical, you have to have a process to remediate quickly. Otherwise, you're just documenting risk. Lucas: That's the hard part. EASM can generate a lot of noise if you're not prepared. The key is to have a clear ownership model — who's responsible for that forgotten dev server? The team that created it? The platform team? You need to map assets to owners. Luna: That sounds like an organizational challenge, not just a technology one. Lucas: It is. But the payoff is real. Companies that implement EASM typically reduce their mean time to remediation for externally exposed issues by sixty to seventy percent in the first year. I've seen that data from multiple vendors. Luna: That's a measurable improvement. And it directly reduces breach risk. Lucas: Exactly. So — if you're evaluating EASM tools, look for integration with your existing ticketing and SIEM. Make sure it covers cloud, on-prem, and third-party. And run a pilot against a subset of your organization first. You'll learn a lot. Luna: And don't forget the human factor. The tool can find the asset, but you need a culture that treats unknown assets as critical incidents. Lucas: Wise words. I think that's a good place to leave it. The one point two billion number tells you the market is convinced. The question is whether your organization is part of that spending — or part of the breach statistics. Luna: It's a choice, and now you know what the tool can do. Lucas: Thanks for listening. We'll be back next time with another angle on the business of cybersecurity.