Skip to content

Beareye · Exposure

EASM (External Attack Surface Management): monitor your external attack surface

By Updated on

EASM (External Attack Surface Management) is the continuous discovery and monitoring of what an organisation exposes on the internet. Beareye’s EASM module inventories everything an attacker can see of your organisation from the internet: domains, subdomains, exposed technologies, email configuration, shadow IT and brand impersonation. It enriches each asset with its risk context, prioritises critical exposures, and continuously monitors changes to your external attack surface.

Map my external exposure
  • Continuous discovery
  • Prioritised by real risk
  • Developed in France

What can an attacker see of your organisation from the internet?

An organisation’s external attack surface changes every week: a forgotten subdomain, an open cloud service, an application published by a subsidiary, an outdated DNS record. These assets often slip out of the official inventory. Yet they are the first things an attacker tests. The EASM module reveals them continuously.

What does Beareye’s EASM module cover?

Beareye’s EASM module covers the inventory of exposed assets and technologies, the assessment of email configurations (SPF, DKIM, DMARC, BIMI), shadow IT detection, testing of exposed websites, and AI-assisted analysis of brand impersonation through typosquatting . To go further: Subdomain takeover and dangling DNS (article in French).

  • Asset and technology inventory

    Domains, subdomains, IP addresses, services and technologies exposed, linked to your organisation and kept up to date continuously.

  • Email: SPF, DKIM, DMARC, BIMI

    Checks on the records that protect your domains against sender spoofing and phishing sent in your name.

  • Shadow IT

    Detection of exposed services outside the official inventory: an application published by a business team, a test environment, a SaaS tool.

  • Testing of exposed websites

    Search for vulnerabilities and misconfigurations in web applications reachable from the internet.

  • Typosquatting

    AI-assisted detection of domains close to yours, registered to deceive your customers or your staff.

How does EASM get from discovery to prioritisation?

The module works in four steps, with no agent and no access to your information system. To compare solutions on these steps, see our criteria grid for comparing EASM solutions (article in French).

  1. Discover

    Continuous mapping of exposed assets, with no agent.

  2. Enrich

    Technologies, ports, certificates and configurations linked to each asset.

  3. Assess

    Vulnerabilities and misconfigurations on the discovered assets.

  4. Prioritise

    Ranking by exposure and criticality, not by raw volume.

Beareye’s EASM module works in four steps: discover, enrich, assess, prioritise.

A workflow ready for your teams

Every exposure detected by EASM is raised in the Beareye Command Center , with an action plan and a remediation ticket. The CISO follows the fix, measures the time to remediate, and replays the analysis to confirm that the asset is no longer exposed.

EASM feeds the discovery stage of a continuous exposure management programme; to see how this approach compares with traditional vulnerability management, compare CTEM and vulnerability management .

Remediation workflow in the Beareye EASM module, anonymised data

EASM or CAASM: what is the difference?

EASM looks at your organisation from the outside, like an attacker with no access. CAASM consolidates the inventory of your internal and cloud assets, with access. The two are complementary: EASM reveals what is exposed, CAASM makes sure no internal asset stays in the shadows.

Differences between EASM and CAASM: point of view, question asked and sources
Criterion EASM CAASM
Point of view External, no access Internal and cloud, with access
Question What does an attacker see? Which assets do we own?
Sources Public internet AD, Azure, O365, GCP, IoT

When does EASM make the difference?

  • After a merger or the integration of a subsidiary

    The domains, certificates and services of the integrated entity escape your inventory. EASM attaches them to your surface and flags those that expose a known flaw.

  • When business teams create shadow IT

    An application published without going through IT becomes an invisible entry point. EASM detects it and brings it back into the remediation workflow.

  • To prepare a NIS2 audit of your external exposure

    An up-to-date inventory of your external exposure and the tracking of its remediation document the risk management that NIS2 expects.

What does a first EASM discovery reveal?

In the first discovery run with Beareye, 99% of the confirmed exposed assets were missing from the inventory the organisation had provided: services, applications and infrastructure that had escaped its oversight. These are the assets an attacker finds first, because nobody is watching them.

Aggregated, anonymised data from Beareye’s EASM module: 20 organisations over two years. Exposed assets confirmed in the first discovery, compared with the inventory supplied by each organisation.

Sources and references

  1. Directive (EU) 2022/2555 (NIS2), EUR-Lex
  2. ANSSI (the French national cybersecurity agency), MonEspaceNIS2 (in French)
  3. IETF, RFC 7208: Sender Policy Framework (SPF)
  4. IETF, RFC 6376: DomainKeys Identified Mail (DKIM)
  5. IETF, RFC 7489: DMARC
  6. BIMI Group, Brand Indicators for Message Identification

Sources consulted on . Report an error: contact+site@bearops.fr

Frequently asked questions

What is external attack surface management (EASM)?

EASM (External Attack Surface Management) is the continuous discovery and monitoring of everything an organisation exposes on the internet: domains, services, applications, configurations. The aim is to spot the entry points an attacker can see before they are exploited.

Does EASM require installing an agent?

No. Beareye’s EASM module works from the outside, with no agent and no access to your information system. It takes the point of view of an attacker who has no rights on your network.

How often is the attack surface analysed?

Discovery is continuous. Beareye detects changes to your external attack surface as they happen and raises new exposures in the Command Center, with an associated action plan.

Does EASM detect shadow IT?

Yes. The module identifies exposed assets that are missing from your official inventory, such as a service published by a subsidiary or an application opened without approval. It is one of the most common blind spots.

See your external attack surface

The Beareye Cyberscore reveals your external exposure in 30 minutes, on your own scope. A BEAROPS engineer walks you through the results.

Map my external exposure