Attack Surface Management
Building a Continuous ASM Program — Asset Discovery, Exposure Prioritization, and Governance for the External Perimeter
Most organizations cannot answer a basic question: what do we expose to the internet? Cloud workloads launch and decommission faster than asset inventories update. Acquisitions bring unknown infrastructure. Shadow IT creates services that never enter the CMDB. The result is a perimeter that grows silently, with exposures that no one is managing because no one knows they exist.
This engagement builds an attack surface management program — not a one-time scan and report. The ASM platform is deployed, the external asset inventory is validated against organizational records, exposure prioritization is configured with ownership assignment, and a governance process is established to keep the program running after the engagement ends.
The engagement closes when the program is operational — when assets are discovered continuously, exposures are prioritized and assigned to owners, and a governance process ensures findings are acted upon. It does not close when a report is delivered.
Who This Is For
Ideal clients for this engagement.
The Problem
What this engagement addresses.
Inventory Debt
Cloud velocity creates and destroys assets faster than quarterly inventories can track. Every deployment cycle, every developer environment, every proof-of-concept creates potential exposure that lives outside the known perimeter.
Unknown Unknowns
Shadow IT, forgotten development environments, acquired infrastructure, and third-party integrations create internet-facing assets that no one in security is aware of. You cannot protect what you cannot see.
Discovery Without Action
Previous external scans produced reports, but reports do not assign ownership, enforce remediation, or establish ongoing monitoring. Findings are reviewed once and forgotten.
No Ownership Model
External assets are discovered, but there is no process to determine who owns them, who is responsible for remediation, and who is accountable for ongoing exposure. Findings without owners do not get fixed.
Cloud and M&A Perimeter Expansion
Every cloud subscription, every acquisition, and every SaaS integration potentially expands the external attack surface. Without continuous discovery, the known perimeter falls further behind the actual perimeter with every passing month.
Deliverables
What you receive.
ASM Platform Deployment
ASM platform configured and operational with discovery scoped to the organization's domains, IP ranges, cloud accounts, and subsidiary infrastructure. Validated against organizational asset records.
Validated External Asset Inventory
Complete inventory of discovered external assets cross-referenced with organizational records. Unknown assets flagged for ownership determination. False positives removed. Asset classification applied.
Exposure Prioritization Framework
Risk-based prioritization of discovered exposures incorporating asset criticality, exposure type, exploitability, and business context. Ownership assigned for each finding category.
Governance Process
Documented governance process for ongoing ASM program operation: discovery review cadence, new asset triage, exposure remediation workflows, escalation procedures, and metrics reporting.
Integration Design
Integration specifications connecting ASM platform output with vulnerability management, SIEM, and ticketing systems. Ensures ASM findings flow into existing operational workflows.
Methodology
How the engagement works.
Scoping & Platform Deployment
Weeks 1 – 2
- Define discovery scope: domains, IP ranges, cloud accounts, subsidiaries
- Deploy and configure ASM platform
- Initial discovery scan and baseline asset inventory
- Cross-reference discovered assets with organizational records
Validation & Prioritization
Weeks 3 – 4
- Validate discovered assets — confirm ownership, remove false positives
- Classify assets by criticality and business function
- Configure exposure prioritization framework
- Assign ownership for discovered exposures
- Design integration with vulnerability management and ticketing systems
Governance & Handoff
Weeks 5 – 6
- Document and deploy governance process
- Train security and operations teams on ASM program operations
- Establish metrics and reporting cadence
- Confirm program is operational and continuous discovery is running
- Knowledge transfer and support transition
Engagement Tiers
Scoped to your architecture.
Standard
Single organization or business unit. ASM platform deployment, asset validation, exposure prioritization, and governance process. Up to 3 root domains.
- ASM platform deployment and configuration
- External asset inventory validation
- Exposure prioritization framework
- Governance process documentation
- Team training
Enterprise
Multi-subsidiary, multi-cloud, or post-M&A environments with complex perimeters. Extended discovery scope and integration with existing security operations.
- Everything in Standard
- Extended discovery scope (subsidiaries, acquisitions)
- Multi-cloud account integration
- SIEM and vulnerability management integration
- Executive reporting and metrics dashboard
- Extended post-deployment support
Prerequisites
- List of known domains, IP ranges, and cloud account identifiers
- Access to DNS records and domain registration information
- Stakeholder available to validate asset ownership during discovery
- Ticketing system available for remediation workflow integration
Frequently Asked Questions
Common questions.
Is this a one-time scan or an ongoing program?
An ongoing program. One-time scans produce a point-in-time report that is outdated within weeks. This engagement deploys the ASM platform for continuous discovery, establishes the governance process for ongoing triage and remediation, and closes when the program is running — not when a report is delivered.
Do you provide the ASM platform, or do we need to procure one?
We can work with your existing ASM platform or recommend and deploy one. The engagement is not tied to a specific vendor. If platform selection is needed, it can be scoped into the engagement or handled through the Security Tool Evaluation offering.
How do you handle false positives in asset discovery?
Every discovered asset is validated against organizational records and confirmed with stakeholders before being added to the managed inventory. False positives are removed during the validation phase. The governance process includes procedures for ongoing false positive management as new assets are discovered.
Related Offerings
Often paired with this engagement.
Vulnerability & Exposure Management
Builds the vulnerability management program that operates on the assets ASM discovers — risk-based prioritization, remediation workflows, and SLA enforcement.
Scanner Deployment & Optimization
Ensures vulnerability scanners cover the assets ASM discovers with authenticated scanning and proper configuration.
Security Operations Assessment
Evaluates how ASM findings and external exposure data flow into SOC detection, alerting, and response processes.
SIEM & Detection Engineering
Detection rules for external attack surface changes — new assets, exposed services, certificate changes — that should generate SOC alerts.
Ready to discuss this engagement?
30-minute discovery call. We will discuss your application architecture, your specific concerns, and whether this assessment is the right fit.