External attack surface glossary
Plain-language definitions for the terms that come up when discussing external attack surface, discovery, and offensive-security assessments.
ASN (Autonomous System Number)
A unique number assigned to a network or group of networks that share the same routing policy on the internet, typically operated by a single organization or ISP. Mapping which ASNs an organization controls is a common early step in external attack surface discovery, since it can reveal IP ranges and infrastructure that never made it into an internal asset inventory.
Asset Discovery
The process of identifying every system, domain, subdomain, and service an organization exposes to the public internet. In an EASM context, discovery works outward from public reconnaissance sources rather than from an existing inventory, which is precisely why it tends to surface assets a CMDB doesn't know about.
Attack Path
A sequence of individually exploitable weaknesses that, chained together, lead from an entry point to a meaningful business impact. A single exposed component is rarely dangerous on its own; an attack path is what happens when several of them connect. See our methodology for how attack-path investigation fits into an assessment.
Attack Surface
Every point where an unauthorized party could attempt to enter or extract data from a system. The external attack surface specifically means everything reachable from the public internet: domains, subdomains, cloud infrastructure, exposed applications, APIs, remote-access systems, and mail infrastructure.
Attack Surface Reduction
The practice of actively shrinking what's exposed, decommissioning unused subdomains, closing unnecessary ports, removing forgotten staging environments, rather than only monitoring what's already there. Reduction is usually the first, cheapest remediation step once an assessment identifies exposure that serves no current business purpose.
Certificate Transparency (CT) Logs
Public, append-only logs of every TLS certificate issued for a domain, required by all major browsers since 2018. Because certificates are frequently issued for new subdomains before anything is even publicly deployed there, CT logs are one of the most reliable passive sources for external discovery, revealing infrastructure that hasn't been announced anywhere else yet.
CMDB (Configuration Management Database)
An internal system of record for an organization's known IT assets and their relationships. A CMDB is only as accurate as what's been manually entered or automatically synced into it, which is exactly the gap external discovery is built to check: see how that compares to vulnerability scanning, which depends entirely on CMDB accuracy.
DNS Enumeration
The process of systematically identifying an organization's DNS records, subdomains, and associated infrastructure. Combines passive techniques (certificate transparency, public DNS datasets) with active queries to build as complete a picture as possible of what a domain and its subdomains actually resolve to.
Exposure
A condition where a system, service, or piece of information is reachable or visible from outside the organization's intended boundary. Not every exposure is a vulnerability, an intentionally public marketing site is exposed by design, but every exposure is worth accounting for, because whether it matters depends on context that's easy to get wrong from the inside.
False Positive
A flagged observation that, on closer inspection, isn't actually exploitable or doesn't represent real risk. Automated discovery tools generate candidates, not findings; the gap between the two is manual validation. A methodology that reports every automated flag without validation will produce a report full of false positives, see our methodology for how validation is meant to filter these out before they reach a client.
Penetration Testing
A security assessment that targets a defined, already-known system or application to find and exploit as many weaknesses as possible within it. Distinct from an external attack surface assessment, which starts with little or no prior knowledge of the environment. Read the full comparison.
Reconnaissance (OSINT)
Open-Source Intelligence gathering: collecting publicly available information about an organization's infrastructure, employees, and technology without directly interacting with target systems. The first phase of both attacker activity and legitimate external attack surface discovery, since both start from the same public information.
Remediation
The work of actually fixing a validated finding, patching, reconfiguring, decommissioning, or otherwise closing an exposure. A useful assessment report prioritizes remediation by actual risk, not by how technically interesting a finding is, so the highest-impact fixes get addressed first.
Rules of Engagement (RoE)
A written agreement defining exactly what's authorized during a security assessment: target scope, exclusions, testing window, permitted and prohibited techniques, and emergency contacts. Testing should never begin before Rules of Engagement are signed, this is what separates authorized assessment work from unauthorized access. See how an engagement starts.
Shadow IT
Infrastructure, applications, or services deployed and used within an organization without the knowledge or approval of its central IT or security function. A frequent source of forgotten external exposure, since shadow IT by definition never made it into the systems that are supposed to track what the organization runs.
Subdomain Takeover
A vulnerability where a DNS record still points to a third-party service (a cloud hosting provider, a SaaS platform) that's no longer active or claimed, allowing an attacker to claim that service and effectively hijack the subdomain. A common finding in external assessments precisely because it originates from forgotten infrastructure rather than a currently maintained system.
Technology Fingerprinting
Identifying the specific software, framework, version, and configuration running on a discovered asset, based on observable signals like HTTP headers, error pages, and response behavior. The output of fingerprinting is a candidate for validation, not a finding on its own; confirming whether a fingerprinted version is actually exploitable in context is a separate, manual step.
Threat Intelligence
Information about active threats, attacker techniques, and known malicious infrastructure, used to contextualize how likely a given exposure is to actually be targeted. Distinct from attack surface management itself, threat intelligence informs prioritization, attack surface management determines what exists to prioritize in the first place.
Vulnerability Management
The ongoing program of identifying, prioritizing, and remediating known weaknesses across an organization's known assets, typically built around recurring vulnerability scanning. Depends entirely on the completeness of the underlying asset inventory, which is exactly where EASM and vulnerability management diverge.
Zero-Day Vulnerability
A software vulnerability that is exploited, or disclosed, before the vendor has released a fix. Zero-days are a real but relatively rare source of external compromise; in practice, most successful external attacks exploit known issues on forgotten or misconfigured assets rather than novel zero-days.