# Attack Surface Management URL: https://www.deepinfo.com/solutions/use-cases/attack-surface-management/ ## Discover Every Internet-Facing Asset and Keep Looking. Attack surface management is the ongoing work of finding everything your organization exposes to the internet, checking it for weaknesses and keeping that picture current. Teams run it on External Attack Surface Management: discovery from a seed domain, layer-by-layer scanning of approved assets and a scored queue that ends at a verified fix. [Request demo](https://www.deepinfo.com/request-demo/) ### The Inventory Is Always a Step Behind. A CMDB lists what someone registered. The internet shows what answers, and the gap between the two is where attackers start. Drift #### Assets Outlive Their Projects A campaign microsite, a test server built for one release, a partner portal nobody switched off. Each keeps answering after its owner has moved on. Growth #### Group Companies and Acquisitions Subsidiaries register their own domains. An acquisition brings infrastructure that nobody has inventoried under your name yet. Change #### Known Assets, Changing Quietly A certificate expires, a port opens, a DNS record points somewhere new. A point-in-time scan only sees the day it ran. ### EASM Takes Each Asset From Scope to Close. Discovery decides what is in scope, scanning keeps it current, detection and scoring decide what matters, and remediation closes it out. #### [Asset Discovery](https://www.deepinfo.com/platform/easm/smart-asset-discovery/) Starts from a seed domain and follows subdomains, the IPs they resolve to, and reverse IP, MX, NS and WHOIS pivots across Deepinfo’s index. Your team approves what belongs to you. #### [Continuous Scanning](https://www.deepinfo.com/platform/easm/continuous-scanning/) Scans every approved asset across WHOIS, IP WHOIS, DNS, SSL, ports, web data and HTTP, and keeps each layer as a dated snapshot. #### [Risk Detection](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/) Raises misconfigurations, weak TLS, expiring certificates, exposed services, public login pages, end-of-life technology and CVEs as issues with evidence. #### [Risk Scoring](https://www.deepinfo.com/platform/easm/complete-risk-scoring/) Scores each asset and domain, and ranks each CVE by CVSS, EPSS and CISA KEV together. #### [Remediation](https://www.deepinfo.com/platform/easm/remediation-with-actionable-insights/) Moves each issue through its states until a rescan confirms the fix, and reopens it if the signal returns. ### Domains, Subdomains and IPs in One Inventory. The inventory lists all monitored domains, subdomains and IP addresses. Each one opens on its own record, with its issues, technologies, open ports and vulnerabilities one tab away. ### From a Seed Domain to a Verified Fix. 1. **Seed** Add your primary domain. If you already know more of your assets, add them too, in bulk through the API. 2. **Review** Discovery candidates land in a queue. Your team approves what belongs to the organization, ignores what doesn’t, and can revert either decision. 3. **Scan** Approved assets are scanned layer by layer. A new certificate, a DNS edit or a newly open port becomes an event. 4. **Prioritize** Issues arrive with a severity from Critical to Information. CVEs are ranked by CVSS, EPSS and CISA KEV together. 5. **Close** Owners work each issue through its states. A rescan confirms the fix, and a returning signal reopens the issue as reappeared. ### What the Team Works From. An inventory that matches what answers on the internet, where every addition is a recorded decision. Changes reach their owners, and reports serve the people tracking risk and the people fixing it. #### Dated Snapshots Each data layer scanned per asset and kept as a dated snapshot. #### Issue States Each issue tracked from newly detected to verified resolved. #### Notifications Changes delivered instantly, or as an hourly to monthly digest. #### Reports From executive summary to vulnerability detail, on demand or on a schedule. ### Where This Workflow Leads Next. - [A national telecom operator](https://www.deepinfo.com/customers/telecommunications-national-operator/) (Customer story): Continuous monitoring across tens of thousands of public-facing assets, with discovery across subsidiary brands. - [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) (EASM): The module this workflow runs on: discovery, scanning, scoring and remediation. - [Vulnerability Management](https://www.deepinfo.com/solutions/use-cases/vulnerability-management/) (Use case): Rank the CVEs on those assets by exploitation signal. ### Use This Data in Your Tools The discovery and scanning data behind this use case is open through the API, for teams that feed it into their own inventory or scanners. - [Subdomain Finder API](https://www.deepinfo.com/data-api/apis/subdomain-finder/) - [DNS Lookup API](https://www.deepinfo.com/data-api/apis/dns-lookup/) - [SSL Lookup API](https://www.deepinfo.com/data-api/apis/ssl-lookup/) - [Port Scan API](https://www.deepinfo.com/data-api/apis/port-scan/) ### Questions About Attack Surface Management **What do we need to start?** A seed, usually your primary domain. The platform proposes related assets and only approved ones join the monitored inventory. Discovery rules you trust can approve their own matches. **Is the scanning intrusive?** No. Nothing is installed and no access is requested: the platform reads what your assets already expose to the internet. Standard monitoring runs no authenticated scans, no exploit attempts and no load tests. **How is attack surface management different from an asset inventory?** An inventory lists what someone recorded. Attack surface management starts from what is reachable on the internet, keeps looking for assets that appear later, and checks each one for weaknesses on an ongoing basis. **How often are assets rescanned?** Approved assets are rescanned on the platform’s own schedule, without anyone triggering it, and each layer keeps its history. For a fresh result, start an instant scan on any asset from the platform or with one API call. **How does it relate to vulnerability management?** Vulnerability management works through the flaws on assets you already know. Attack surface management decides what those assets are in the first place and feeds new ones into the same queue. See [Vulnerability Management](https://www.deepinfo.com/solutions/use-cases/vulnerability-management/) for how that queue is ranked. **Can the inventory feed our CMDB?** Yes. Asset search has an export twin that returns all matches as CSV or JSON without paging, and the approved inventory is available through the [EASM API](https://docs.deepinfo.com/reference/easm/), so the CMDB can be reconciled against what answers on the internet. **Can subsidiaries be tracked separately?** Yes. Each group company can run as its own portfolio with its own asset list, issues and score, the way [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) handles vendors. See [Subsidiary Oversight](https://www.deepinfo.com/solutions/use-cases/subsidiary-oversight/). ### See the Surface You Have. Book a demo and watch discovery run against your primary domain with our team. [Request demo](https://www.deepinfo.com/request-demo/)