Attack Surface Management

Discover the public surface you have but forgot about. Subdomains, exposed admin panels, dev environments leaking to the internet, S3 buckets, abandoned cloud services. You can't protect what you don't know exists.

Why ASM is the missing scanner

DAST + SAST + SCA all assume you know what assets you have. ASM works backwards: starts from your owned domains + cloud accounts and discovers everything you forgot. The classic failure mode it catches: a developer spun up old-staging.yourcompany.comthree years ago, the developer left, the service is still running, still exposed, and still has 2019's vulnerabilities.

Discovery sources

Subdomain enumeration (DNS + cert transparency logs)
AWS resource scan (EC2, ELB, S3, CloudFront, API Gateway, Lambda)
GCP resource scan (Cloud Run, GCE, Load Balancers, GCS)
Azure resource scan (App Service, VMs, Front Door, Blob)
Cloudflare DNS records
Shodan / Censys passive scan
WHOIS + ASN ownership trees
GitHub org-wide search (exposed dev URLs in code)

Asset classification

Each discovered asset is auto-tagged:

  • Type — web app / API / static site / object store / database / mail / unknown
  • Risk class — internet-facing vs. supposedly-private
  • Tech stack — detected framework + server + cert issuer
  • Last-changed — when this asset last had a content/cert/DNS change
  • Auto-scan eligibility — whether ASM can auto-run DAST on it

Risk surfacing

ASM doesn't just list assets — it scores them:

  • Shadow IT — asset on your domain you didn't register in the inventory.
  • Forgotten staging — asset with dev/, staging/, test/, uat/, preview/ patterns.
  • Expired cert — TLS certificate near or past expiry.
  • Outdated tech — versions with known CVEs (cross-referenced with NVD).
  • Open admin panel — common paths (/admin, /wp-admin, /phpmyadmin) reachable without auth challenge.
  • Public storage — S3 buckets / GCS buckets with public read.
  • Mail misconfig — missing SPF, DMARC, DKIM, MTA-STS.

Auto-scan integration

ASM auto-promotes discovered web app assets into DAST scan schedules. New asset appears → 24h delay (to let you review) → Quick DAST scan runs → findings join your queue tagged with the asset.

Disable auto-promotion at Settings → ASM → Auto-scan policy if you want explicit approval per asset.

Continuous monitoring

ASM re-runs discovery weekly. New assets trigger alerts. Disappeared assets are marked archived (history retained for audit). Changes to existing assets (cert renewed, tech version updated, port changes) appear in the change log.

What's next

  • DAST — what ASM auto-promotes assets into.
  • Monitoring — continuous detection beyond scheduled scans.