Attack Surface Ranked

ASM UNIVERSITY · BASICS · LESSON 02

How attack surface discovery works: seeds, seedless discovery and attribution

Quick answer

An ASM tool finds internet-facing assets by starting from what it knows about you and expanding outward. Seeded tools start from domains, IP ranges or ASNs you supply; seedless tools start from the organization's name. Either way the result is only useful once each asset is attributed to the right entity and owner.

Attack Surface Ranked analysts · 4 September 2026 · 2 min read

Where does discovery start?

Every discovery process needs a starting point. The most common is a seed: a known asset such as a domain, an IP block or an ASN. Censys ASM documents seeds that customers add in its console or through its API. Microsoft Defender EASM documents seeds and recursive discovery, and also offers a prebuilt inventory to begin from.

Other tools ask for less. CyCognito says its discovery starts from the organization's name, with no IP ranges and no asset lists. Seeded discovery gives you control over scope. Seedless discovery is designed to find what you did not know to seed, which matters most for groups with many acquisitions.

How does a tool expand from the starting point?

Most tools map recursively. Each asset they find is checked for links to other assets, such as shared registration details, DNS records, certificates, IP ownership and hosting, and every new asset becomes a new starting point. IONIX describes its Connective Intelligence engine this way and says it extends into third- and fourth-party supply-chain assets.

Cortex Xpanse works from the other direction. Palo Alto Networks says it scans the full IPv4 space several times a day and matches what it finds to each customer. Both approaches end in the same place: a list of assets that probably belong to you.

Why does attribution matter as much as discovery?

Finding an asset is not the same as knowing it is yours. A false match wastes analyst time, and testing a system you do not own can create legal exposure. Good tools show the evidence for each match and park doubtful ones in a separate state. Microsoft Defender EASM, for example, uses states such as Approved Inventory, Candidate and Requires Investigation.

In a group with subsidiaries, attribution also means deciding which entity and owner each asset belongs to. IONIX, CyCognito and watchTowr document attribution to subsidiaries.

What should you check in a trial?

  • What the tool needs from you to start.
  • The evidence behind five assets you did not know about.
  • How doubtful matches are handled, and who confirms them.
  • Whether each asset is attributed to a subsidiary and an owner.

For a full evaluation checklist, see the buyer's guide.

Terms in this lesson: Discovery seed, Seedless discovery, ASN, Attribution, Shadow IT

Sources: CyCognito, Discovery, Censys docs, Seed your attack surface, Microsoft Learn, What is discovery, IONIX, Attack Surface Discovery, Palo Alto Networks, Cortex Xpanse