What is External Attack Surface Management (EASM)?

By the zmam.ai team · 29 May 2026

On this page

Ask a security team to list everything their organisation exposes to the internet and you will get a confident answer that is almost always incomplete. The gap between what an organisation thinks it exposes and what it actually exposes is where attackers live. External Attack Surface Management — EASM — is the discipline of closing that gap by continuously discovering and reviewing everything about you that is reachable from the public internet, from the same vantage point an attacker uses.

Your external attack surface is the sum of those exposed assets: domains, subdomains, certificates, mail configuration, web servers, and any service listening on a public address.

Why the outside view is the one that matters

Attackers do not begin with a map of your network. They begin by looking at what is public, and they start with the weakest thing they find — an expired certificate, an unauthenticated mail domain, a forgotten subdomain running old software, a VPN portal a version behind. The breaches of 2025 made this almost monotonous: the CitrixBleed 2 campaign , the Cisco and Ivanti edge-device waves, the file-transfer extortion sprees — all of them found their victims by enumerating exposed interfaces, not by clever insider knowledge. The defenders could have seen the same thing, for free, first.

Why it grows while you are not looking

The external surface expands through ordinary, reasonable work:

Marketing spins up a campaign subdomain that is never decommissioned.
A team adopts a new SaaS tool and adds DNS records for it.
A test or staging environment is left publicly reachable “just for now.”
A certificate is issued, then forgotten until it expires.

Each step is sensible in isolation; together they create exposure nobody is tracking. That is why EASM stresses continuous discovery over the one-time audit: the surface you signed off on last quarter is not the surface you have today.

What an external review looks at

Domains and subdomains — including the forgotten ones.
TLS/SSL certificates — validity, coverage, and configuration.
Mail authentication — SPF, DKIM, and DMARC.
HTTP security headers — what each property does and does not send.
Exposed services and ports — what is listening on the public internet.
Known vulnerabilities — in the software those services advertise.

EASM is not a penetration test

EASM is broad, continuous, and non-intrusive: it maps and monitors what is exposed without exploiting anything. A penetration test is narrow, point-in-time, and active: a tester deliberately attacks specific systems to prove what is possible. The two are complementary. EASM tells you what to worry about; a pen test tells you how bad a particular worry really is.

How zmam.ai helps

zmam.ai brings the external, non-intrusive part of EASM to organisations that want a clear starting point. It reviews your public configuration — DNS, TLS, HTTP security headers, and mail authentication — and emails a plain-language report. Deeper discovery, such as port and service enumeration and known-vulnerability lookups, is in development.