Verizon's 2024 Data Breach Investigations Report found that external actors were involved in 65% of breaches, while internal actors served as the catalyst for 35%. Separately, the Open Web Application Security Project's 2021 Top 10 list found that broken access control was the top security risk that year, with researchers noting 3.8% of applications tested had one or more weaknesses in that category, totaling more than 318,000 occurrences. Both findings point to the same problem: attackers rarely need to breach a firewall when a forgotten subdomain, an exposed cloud storage bucket, or a misconfigured login page sits in plain view on the internet.
External Attack Surface Management, commonly called EASM, is the discipline built to find those exposures before an attacker does. This article explains what EASM covers, ties it directly to the Center for Internet Security's 18 Critical Security Controls, and outlines how it complements vulnerability and patch management rather than replacing it. The central position here is straightforward: a vulnerability management program that never looks outward from an attacker's vantage point leaves gaps that internal scanning alone cannot close.
What Is External Attack Surface Management (EASM)?
External Attack Surface Management describes a category of practices and tools that continuously discover, inventory, and monitor an organization's internet-facing assets from the outside in. Gartner is credited with formalizing the term, having created the category in 2021 to describe products supporting organizations in identifying risks from internet-facing assets and systems they may be unaware of. In practical terms, EASM platforms identify unknown or unmanaged assets, exposed services, misconfigurations, and vulnerabilities across cloud, Software as a Service, on-premises, and third-party environments.
The distinguishing feature of EASM is perspective. Traditional vulnerability scanning starts from an internal asset list and checks those known systems for weaknesses. EASM starts with no list at all, instead mapping every domain, subdomain, IP range, and cloud service that a search of public records, certificate logs, and internet scans can associate with an organization. The result often surprises leadership teams: forgotten marketing microsites, staging environments never taken offline, and developer test instances still connected to production data.
Attack surfaces are also growing rather than shrinking. Industry research cited by attack surface management vendors found that a majority of organizations have seen their internet-facing footprint expand in recent years, driven largely by cloud adoption, remote work, and faster software release cycles.
Why Vulnerability and Patch Management Programs Miss External Exposures
Vulnerability and patch management programs remain essential, but they are built around a known inventory. Patch management assumes a system has already been identified, categorized, and scheduled for updates. That assumption breaks down the moment an asset exists outside the inventory entirely, whether because a marketing team spun up a landing page without informing security, a developer left a test interface online, or an acquisition brought in infrastructure nobody has fully mapped.
Broken access control illustrates the point well. The Open Web Application Security Project's research found that 94% of applications tested showed some form of broken access control, with an average incidence rate of 3.8%, the highest of any category measured. Many of these flaws surface on public-facing login portals, customer dashboards, or partner interfaces, the kind of asset an internal vulnerability scanner may never touch if it sits outside the defined scan range. EASM closes that visibility gap by treating the entire internet-facing footprint as fair game for discovery, regardless of whether an asset was ever formally added to an inventory list.
How EASM Maps to the CIS Top 18 Controls
The Center for Internet Security publishes a set of prioritized security practices known as the Critical Security Controls, organized into 18 controls covering areas from asset inventory to penetration testing. Control 1 of the current version calls for actively managing the inventory, tracking, and correction of all enterprise assets connected to the infrastructure, whether physical, virtual, remote, or within cloud environments, so the organization knows the totality of assets that need protection. EASM aligns directly with several of these controls rather than sitting apart from them as a separate tool.
The clearest connections between EASM and the CIS 18 include:
- Control 1, Inventory and Control of Enterprise Assets: requires organizations to address unauthorized and unmanaged assets, which is precisely what EASM discovery surfaces from the outside.
- Control 7, Continuous Vulnerability Management: includes a specific safeguard to perform automated vulnerability scans of externally-exposed enterprise assets, the exact function EASM tools automate at scale.
- Control 16, Application Software Security: covers the secure development and maintenance of internet-facing applications, the same applications EASM continuously maps and assesses.
- Control 18, Penetration Testing: validates whether discovered exposures are actually exploitable, giving EASM findings a real-world risk context.
Reviewed together, these controls show that EASM is not a competing framework. It functions as an operational layer that feeds accurate, current data into a CIS Top 18 program, particularly for the asset inventory and vulnerability management controls that depend on complete visibility to work as intended.
EASM in Practice for SMBs
Small and mid-sized organizations often assume attack surface management tools exist only for large enterprises with sprawling infrastructure. In reality, smaller organizations frequently carry a disproportionate amount of external risk relative to their security staffing, since a handful of IT administrators cannot manually track every subdomain, cloud instance, or third-party integration a fast-moving business creates.
A practical EASM adoption path for a growing SaaS or healthcare organization typically includes:
- Running an initial external discovery scan to build a baseline inventory of internet-facing assets, independent of what internal records show.
- Comparing that discovered inventory against the existing asset list required under CIS Control 1 to identify gaps.
- Feeding newly discovered assets into the existing vulnerability management process under CIS Control 7, rather than managing them separately.
- Scheduling recurring discovery scans, since new subdomains, cloud services, and forgotten test environments appear continuously as teams ship new features.
- Prioritizing remediation based on business relevance and exploitability, not just the number of exposures found.
This approach keeps EASM tied to existing workflows instead of becoming a standalone dashboard that security teams check occasionally and then ignore.
EASM and CIS 18: A Complement, Not a Replacement
Framing EASM as a replacement for vulnerability and patch management misunderstands both disciplines. Patch management closes known weaknesses in known systems on a predictable schedule. EASM answers a different question: does the organization actually know the full scope of what needs patching in the first place? A CIS 18 program that skips external discovery risks investing significant effort into securing a partial inventory while the actual internet-facing footprint remains larger and less understood.
Moving Forward with EASM
A vulnerability and patch management program built only on internal, known assets addresses part of the risk picture. External Attack Surface Management fills the remaining gap by mapping what an attacker actually sees, feeding that visibility directly into CIS Top 18 controls like asset inventory and continuous vulnerability management. Organizations that treat EASM as a complement to existing programs, rather than an afterthought, build a more complete and defensible security posture.
Planet 9 is a Bay Area cybersecurity consulting firm specializing in SOC 2 and HIPAA readiness for SMBs in healthcare, SaaS, and technology. Our vCISOs and compliance managers help organizations choose the right approach, configure governance, risk, and compliance tools if needed, and get audit-ready without wasted time.
