Attack Surface Management (ASM)

Attack surface management (ASM) is the continuous discovery, assessment and reduction of every point through which an attacker can reach a company. The attack surface covers externally reachable systems, internal networks, cloud accounts, identities and the traces a company leaves on the dark web. ASM turns all of this into a continuously updated inventory and rates every entry by its risk.

Why attack surface management matters

Most successful attacks do not start with a sophisticated zero-day but with a system nobody had in mind: a test server from an old project, a subdomain still pointing at a cancelled cloud instance, a VPN gateway with outdated firmware, or a password that an infostealer put into circulation. Conventional vulnerability scans only check what they are told to check. Attackers check everything. ASM closes this gap by switching perspective: what is reachable from the internet, what of that is vulnerable, and what of that is actually exploitable?

For companies under NIS2, DORA or ISO 27001, a current asset inventory is no longer optional but an auditable foundation of risk management.

How attack surface management works

ASM runs as a cycle of four steps:

1. Discovery: Starting from a few seeds (main domains, IP ranges, cloud accounts), subdomains, hosts, open ports, services, web applications, certificates and technologies in use are discovered automatically. Good solutions suggest additional assets, for example from RIPE registrations or cloud inventories.
2. Assessment: Every asset is checked for vulnerabilities, misconfigurations and exposed services and enriched with context: is an exploit public? Is the vulnerability in the CISA KEV catalogue? What is the EPSS score?
3. Prioritisation: Reachability, exploitability and criticality produce a ranking that says what to fix first.
4. Remediation and evidence: Findings are assigned, fixed and closed automatically by a re-scan.

The difference from a one-off audit lies in the word "continuous": the attack surface changes daily, so the inventory has to keep up daily.

How blacklens.io implements attack surface management

blacklens.io brings external discovery (domains, subdomains, IPs, services, web apps, technologies, certificates), internal scans via the Sentry agent, cloud inventories from AWS, Azure, Microsoft 365, GCP, Cloudflare and Hetzner, and dark web signals together in one workflow. New CVEs are matched in real time against the technology inventory; findings are prioritised by EPSS, CISA KEV and exploit availability. Assets that have not been seen for seven days disappear from the inventory automatically so that it reflects reality.

What is the difference between ASM and vulnerability management?

Vulnerability management checks known systems for known vulnerabilities. ASM starts one step earlier and first finds out which systems exist and are reachable at all. In practice the two complement each other: ASM provides the inventory, vulnerability management the testing and remediation process.

How often should the attack surface be mapped?

Continuously. New subdomains, cloud resources and services appear daily, and new vulnerabilities are published hourly. A weekly or monthly scan gives attackers several days' head start on average.

Do small companies need attack surface management?

Yes, especially them. Small and mid-sized companies rarely have a complete inventory and no security team of their own to keep it up. Automated ASM does not replace a security owner, but it gives them the list they can work with.