Ask an IT manager how many internet-facing systems the company has and you will usually get a confident number. Run a discovery scan and the real number is typically two to three times higher. The difference is the part of your attack surface that nobody is protecting, and it is where attackers start.
What is an attack surface?
Your external attack surface is every asset reachable from the internet that an attacker could use as an entry point: web applications, APIs, mail servers, VPN gateways, remote desktop endpoints, cloud storage, CI/CD tooling, and the DNS records and certificates that tie them together.
It grows silently. A marketing agency spins up a campaign site on a subdomain. A developer leaves a staging environment online. An old product keeps running on a server everyone forgot about. A SaaS tool is connected through a CNAME that still points at a service you cancelled, which is a classic subdomain takeover.
What attack surface management (ASM) does
ASM is a continuous loop with four stages:
- Discovery. Enumerate every subdomain, host and service under your domains, including ones not in your inventory, using DNS data, certificate transparency logs and active probing.
- Assessment. Fingerprint each asset (web server, framework, versions, open ports) and scan it for known vulnerabilities and misconfigurations. SecurityScanner.AI uses more than 11,200 ready attack templates for this stage.
- Validation. Confirm which findings are actually exploitable. Automated penetration testing separates a theoretical version match from a real, demonstrable weakness and cuts the noise that makes vulnerability reports unreadable.
- Prioritisation and reporting. Score findings with CVSS and business context, assign them, fix them, and re-test. Export an executive report for management and audit evidence for compliance.
Then it starts again, because tomorrow someone will register a new subdomain.
ASM versus the annual penetration test
A manual penetration test is valuable: a skilled human will find logic flaws no scanner can. But it has three problems for a small or mid-sized business.
- Cost. A proper engagement runs into thousands of euros, so it happens once a year at best.
- Scope. You tell the tester what to test. Forgotten assets are, by definition, not on the list.
- Shelf life. The report is accurate on delivery day. By the next quarter, new CVEs, new deployments and new misconfigurations have changed the picture.
Continuous ASM fills the gaps between engagements. The practical combination for most companies is monthly or weekly automated discovery and testing, plus a manual pentest on the critical application once a year.
The findings that show up most often
Across small and mid-sized environments, the same categories dominate:
- Outdated web software with public exploits (CMS plugins, frameworks, libraries).
- Exposed admin interfaces, databases or management ports that should never face the internet.
- Forgotten staging and test environments with weak or default credentials.
- Dangling DNS records enabling subdomain takeover.
- Missing security headers, weak TLS configuration and expired certificates.
- Secrets and configuration files left in web roots or public code repositories.
None of these require a sophisticated attacker. They require someone to look, and automated attackers look at everything.
How to start
- Verify ownership of your primary domains in an ASM platform.
- Run discovery and compare the result with your own inventory. The difference is your first to-do list.
- Fix or decommission what should not be online at all. This usually removes a large share of findings at zero cost.
- Schedule recurring scans and route alerts to the person who can act on them.
- Map findings to your compliance framework so the same work doubles as audit evidence.
If you want to see what this looks like on your own domain, SecurityScanner.AI attack surface management runs discovery, scanning and automated pentesting from a single dashboard, with reports your management can read.