TOOL TYPE · EASM
What is EASM discovery? Finding the internet-facing assets you actually own
SHORT ANSWER
EASM discovery finds the domains, IP addresses, certificates, cloud services and applications your organisation exposes to the internet, including the ones nobody put on a list, and ties each one to an owner. It is the first job of attack surface management. It matters most after acquisitions, in groups with many brands, and wherever teams can create internet-facing services without central approval.
By The Exposure Desk · Exposure Management Finder · Published 2026-10-11
Desk research from public vendor pages read in September 2026, updated 2026-10-11. Profiles follow our published method; we did not run the products.
What does EASM discovery do?
A discovery tool starts from a small amount of information, such as a company name, a domain or a few IP ranges, and works outward: related domains, subdomains, certificates, IP blocks, cloud resources and the services running on them. Some vendors also draw on their own scans of the whole internet.
The hard part is attribution. A domain that looks like yours may belong to a reseller, a former subsidiary or an unrelated company. Good discovery shows why an asset was linked to you and lets you accept or reject doubtful matches.
The output is an inventory that changes every day: new assets appear, old ones disappear, and some stay online long after anyone remembers them.
When do you need it?
- You have subsidiaries, brands or acquisitions whose assets are not in your main inventory.
- Development or marketing teams can launch internet-facing services without a central review.
- You have been surprised by an asset during an incident or an audit.
- You need to show regulators or a board what you expose to the internet.
Where does it stop?
Discovery tells you what you have, not which of it an attacker could use. A complete inventory can still produce thousands of findings with the same apparent severity. Pair discovery with validation to prove what is exploitable, and with a way to route findings to the people who own each asset.
Which finder answers point to EASM?
- +2 if your answer to "How is your organisation put together?" is "One organisation with one main brand"
- +3 if your answer to "How is your organisation put together?" is "Several brands or business units"
- +5 if your answer to "How is your organisation put together?" is "Many subsidiaries, or acquisitions in the last three years"
- +1 if your answer to "Where do your internet-facing systems run?" is "Mostly public cloud"
- +1 if your answer to "Where do your internet-facing systems run?" is "A mix of cloud and on-premises"
- +1 if your answer to "Which security platform or scanner do you already run?" is "None of these"
- +1 if your answer to "How much proof do you need that an exposure is real?" is "A prioritised list is enough for now"
Which vendors describe EASM?
10 of 10 vendors describe EASM discovery on the pages we read, and 0 are not in our sources.
| Vendor | Status | What their pages say | Source |
|---|---|---|---|
| Censys ASM | Described | First-party scanning across all 65K ports finds services on nonstandard ports and hosts with self-signed certificates. | Source: Censys external exposure management · Read 27 Sep 2026 |
| Cortex Xpanse | Described | Palo Alto Networks says Xpanse scans all 4.3 billion IPv4 addresses multiple times a day and more than 500 billion ports daily. | Source: Cortex Xpanse · Read 27 Sep 2026 |
| CrowdStrike EASM | Described | Identifies external exposed assets, including shadow IT, and scans the internet 24/7. | Source: CrowdStrike EASM (Falcon Exposure Management) · Read 11 Oct 2026 |
| CyCognito | Described | Starts from the organisation's name with no IP ranges or asset lists, and attributes assets to subsidiary, brand or business unit. | Source: CyCognito discovery · Read 27 Sep 2026 |
| Hadrian | Described | Continuous discovery with hourly or event-triggered scans; machine learning confirms asset ownership. | Source: Hadrian technology · Read 27 Sep 2026 |
| IONIX | Described | Discovery with 13 techniques, including third- and fourth-party assets in the digital supply chain. | Source: IONIX attack surface discovery · Read 27 Sep 2026 |
| Microsoft Defender EASM | Described | A prebuilt inventory for many organisations plus recursive discovery from seeds you supply. | Source: Microsoft Learn: what is discovery · Read 27 Sep 2026 |
| Rapid7 Surface Command | Described | Internal and external attack surface visibility, including unknown internet-facing assets and shadow IT. | Source: Rapid7 Surface Command · Read 27 Sep 2026 |
| Tenable Attack Surface Management | Described | Identifies domains related to your inventory from a map of 5 billion+ assets, with 200+ metadata fields. | Source: Tenable Attack Surface Management · Read 27 Sep 2026 |
| watchTowr | Described | Maps discovered assets to subsidiaries, brands and M&A activity. | Source: watchTowr platform · Read 27 Sep 2026 |
Not in our sources is not a no. Ask the vendor, and send us a public source if one exists.
What should you ask a vendor?
- What is the least information you need from us to start: a company name, a domain, or a list of seeds?
- How do you show why an asset was attributed to us, and to which subsidiary or owner?
- How often is the inventory refreshed, and how fast does a new asset appear?
- What happens to assets we mark as not ours?
Questions readers ask
What is a seed in EASM?
A seed is a starting point you give a discovery tool, such as a domain, an IP block or an organisation name. Some vendors need seeds before discovery starts; others start from the company name alone.
Does EASM find assets inside my network?
Not usually. EASM looks from the internet inward. Tools that combine external discovery with an internal asset inventory often call the combination CAASM.
How do vendors handle subsidiaries?
It varies. Some describe attributing each asset to a subsidiary, brand or business owner automatically; others describe ownership in general terms. The table above and the subsidiary check in the finder show what each vendor's pages say.