Notes on external attack surfaces
Practical, technically grounded writing on attack surface discovery, validation, and the difference between scanning and testing, for security leaders and practitioners.
Continuous Monitoring vs. Point-in-Time Attack Surface Assessment
Continuous monitoring catches change fast. Point-in-time assessment goes deep enough to validate it. Most mature programs need some version of both.
DIY vs. Managed Attack Surface Monitoring: How to Decide
Anyone could run this in-house. The real question is whether a periodic, independent check beats stretching your own team's time across ongoing…
External Attack Surface Management vs. Vulnerability Scanning
Vulnerability scanning checks known assets against known weaknesses. EASM finds the assets your scanner never knew to check. Here's how they actually…
How to Scope an External Attack Surface Assessment: A Buyer’s Checklist
The checklist we walk through with prospective clients before writing a proposal, useful whether you're scoping with us or anyone else.
5 Types of Unknown Assets That Expand Your Attack Surface
The assets that matter most in a discovery engagement are rarely the ones already in your inventory. Five categories we find repeatedly,…
External Attack Surface Assessment vs. Penetration Testing: What’s the Difference?
They sound similar but answer different questions. Here's the practical difference, and how to decide which one you need, or whether you…
What Is External Attack Surface Management (EASM)?
EASM tools are good at discovery at scale. Here's what they're built for, and where automated discovery stops being enough on its…