What is attack surface management? A plain introduction

What is an attack surface?

An attack surface is every point where an attacker could try to get in: internet-facing hosts, web applications, APIs, cloud resources, exposed credentials and connections to third parties. For a large organization it changes every week. Teams launch marketing sites, developers open test environments in cloud accounts, acquisitions bring whole estates nobody in the parent's security team has seen, and suppliers change the services your own sites depend on.

The part that causes most trouble is the part nobody listed. An asset that is not in the inventory has no owner, so it is not patched, not monitored and not retired when the project ends. Attackers do not need to know your organization chart. They need one forgotten host.

What does an ASM tool actually do?

Vendors describe the work in slightly different terms, but the stages are consistent. IONIX, for example, describes a six-stage workflow: discovery, inventory, assessment, validation, prioritization and remediation. In plain terms:

• Discovery: find internet-facing assets, including unknown ones, starting from a company name, a domain or seeds you supply. See how discovery works.
• Attribution: decide which assets really belong to you, and to which subsidiary and owner.
• Assessment: identify exposures on each asset, such as outdated software, misconfigurations and exposed services.
• Validation: confirm, with a safe test, which exposures can actually be exploited.
• Prioritization: order the work by exploitability, threat signals and business context.
• Remediation: route each finding to its owner, apply a compensating control where the fix will take time, and retest once it is fixed.

Every tool in our ranking does discovery. They separate on the later stages. That is why our weights give remediation 20% and validation 15%, and why our findings table records what each finding arrives with.

What is ASM not?

• It is not a vulnerability scanner for known internal hosts, although many ASM products feed into one.
• It is not a penetration test, although some tools, such as Hadrian's NOVA, sell penetration testing alongside ASM.
• It is not a program. CTEM, continuous threat exposure management, is the program that ASM tools feed. See What is CTEM.
• It is not only external. ASM is the umbrella term; EASM is the outside view and CAASM the internal inventory built from your existing tools. See ASM vs EASM vs CAASM.

Why does the category matter more in 2026?

Volume. FIRST forecast in June 2026 that about 66,000 CVEs will be published this year. Every new CVE can match software running on internet-facing assets, so a tool that only lists matches produces a longer queue each month. FIRST also noted that, filtered for CISA KEV entries or EPSS scores above 10%, the patching burden has not materially increased. The useful tools are the ones that narrow the list to what is exploitable on your assets and help close it.

Where should you go next?

The next lesson explains how tools find assets and why attribution matters as much as discovery. If you are already evaluating tools, the score matrix shows how ten of them score on seven criteria, and the score calculator lets you apply your own weights.