What does each term cover?
| Term | Looks from | Finds | Typical inputs | Tools in this ranking |
|---|---|---|---|---|
| ASM | Both, depending on vendor | Any asset that can be attacked | Varies | All ten describe themselves in ASM terms |
| EASM | Outside, over the internet | Internet-facing assets, including unknown ones | A company name, a domain or seeds | IONIX, CyCognito, watchTowr, Hadrian, Cortex Xpanse, CrowdStrike EASM, Censys ASM, Microsoft Defender EASM, Tenable ASM |
| CAASM | Inside, through APIs to existing tools | Assets your tools already know about, reconciled | Connectors to CMDB, EDR, cloud, identity | Rapid7 Surface Command (combines EASM and CAASM) |
Why is the terminology confusing?
Vendors use ASM and EASM interchangeably, and several have coined their own labels for the same work. Buyers mostly use the plain terms: attack surface management, EASM and CTEM. We use ASM as the umbrella term and EASM when we mean the outside view specifically.
Which one do you need first?
If your risk is assets nobody listed, such as acquired companies, marketing sites or forgotten cloud resources, start with EASM, because CAASM can only reconcile what your tools already see. If your problem is conflicting records across tools you already run, CAASM helps first. Large groups usually need both.
Where do exposure validation and CTEM fit?
Exposure validation proves whether a finding can be exploited; some ASM tools include it (see the validation scores on score matrix). CTEM is the program that ties discovery, validation and remediation together. See What is CTEM.
Frequently asked questions
Is EASM the same as ASM?
Often used that way, but ASM is broader and can include internal inventory.
What does CAASM stand for?
Cyber asset attack surface management.
Do I need both EASM and CAASM?
Large enterprises usually do: EASM finds what is unknown outside, CAASM reconciles what is known inside.