External attack surface management (EASM) is software that finds everything a company exposes to the internet, including the servers, apps and websites that nobody inside the company has listed. The attack surface is the set of all the points where an attacker could try to get in. External means the part that anyone on the internet can reach.
Companies lose track of what they expose. A team sets up a test website for a project and forgets it. A marketing agency builds a campaign page on its own server. A company buys another company and inherits its servers. None of these appears in the IT team's list. An attacker begins by making exactly this list. EASM makes it for the defender first.
EASM starts from very little: the company's name and its main domain name. From there, it searches public sources. DNS records show the company's subdomains, such as test.example.in. Public logs of security certificates show every website name for which the company has obtained a certificate. Scans of the whole internet show which addresses answer, and which software they run. App stores show the company's mobile apps.
Consider a food-delivery company in Hyderabad. Its security team believes that it has 140 websites and servers on the internet. EASM finds 212. One of the extra ones is an old staging server, a copy of the app that developers once used for testing. It still accepts logins with a default password. EASM also downloads the company's Android app and reads its code. Inside the code, it finds a hard-coded secret: a key to the company's cloud storage, left there by a developer. The team switches off the staging server the same day and replaces the key.
EASM keeps watching every day, because the list changes every day. Each new server or app that appears is checked again.
What happens to the findings? A newly found server is added to the list that the vulnerability scanner checks for known flaws. Vulnerability intelligence shows whether attackers are using any flaw on it right now. A problem inside a mobile app goes to the team that builds the app, and may lead it to add mobile app shielding.
EASM is different from a vulnerability scanner. A scanner checks the machines that a company already knows about, in depth. EASM finds the machines that the company did not know about, from the outside, as an attacker would.