ASM UNIVERSITY · SEPTEMBER 2026
ASM University: attack surface management lessons and glossary
Quick answer
Nine short lessons in three tracks and a 43-term glossary for teams that run or buy attack surface management tools. Start with Basics, then From finding to fix, then Buying and running. Each lesson takes a few minutes and ends with a link to the next.
What are the tracks?
9 lessons · about 16 minutes in total
Basics
What attack surface management covers, how discovery works, and the public standards behind a finding.
01
What ASM is
What attack surface management covers, what it does not, and where it sits.
2 MIN READ
Read the lesson02
How discovery works
Seeds, seedless starts, recursive mapping and attribution.
2 MIN READ
Read the lesson03
CVE, CVSS, EPSS and KEV
The four public standards most findings refer to, and what each one does not tell you.
2 MIN READ
Read the lessonFrom finding to fix
What validation proves, how a finding gets closed, and how to attribute assets across a group.
04
What validation proves
How validation differs from scanning, and where it stops.
1 MIN READ
Read the lesson06
Attribution across a group
Subsidiaries, acquisitions and suppliers: deciding what is yours and who owns it.
2 MIN READ
Read the lessonBuying and running
How to turn our criteria into requirements, run the program day to day, and measure whether exposure is going down.
07
Writing requirements
Turn seven scoring criteria into requirements a vendor has to answer.
2 MIN READ
Read the lesson08
Running the program
Owners, approvals for active testing and mitigation, and service levels.
2 MIN READ
Read the lesson09
Measuring the program
Metrics that show exposure going down, and the ones that only show activity.
2 MIN READ
Read the lessonWhere are the definitions?
Glossary
43 terms, A to W, with sources for terms that come from standards bodies and regulators.
Open the glossary