What Is External Attack Surface Management (EASM)?

Your attack surface is everything about your infrastructure that's reachable from the public internet: your domains and subdomains, the DNS records that point to them, the ports and services listening on the servers behind them, the TLS certificates serving them, and the web endpoints those servers expose. EASM (external attack surface management) is the practice of continuously knowing what that surface actually looks like right now - not what a spreadsheet from eight months ago says it looks like.

Why this doesn't stay accurate on its own

Nobody sits down and deliberately expands their attack surface. It happens as a side effect of normal work: a developer spins up a service on a new port during a deploy and forgets to close it, marketing stands up a subdomain for a campaign that outlives the campaign, a certificate gets renewed by an automated process and nobody checks it went smoothly, a DNS record gets added for a one-off test and stays forever. Individually these are minor. Collectively, over months, they're the reason "what's actually exposed" and "what we think is exposed" drift apart.

What EASM tools actually do

Most tools in this category cover some combination of:

• Discovery - finding the subdomains, hosts, and services that make up your surface.
• Continuous monitoring - checking again on a schedule, not just once.
• Change detection - comparing this check against the last one, so you see what's new, not everything again.
• Alerting and workflow - telling the right person, and giving them a way to say "reviewed, expected" so the same thing doesn't alert forever.

Two different approaches, and why the difference matters

Broadly, tools in this space take one of two shapes. The first indexes the entire public internet - scanning wherever it likes, whether or not the owner asked for it - and lets you search what it already knows about a target. That's genuinely useful for research and one-off lookups, and it's a different job with a different trust model: the tool isn't watching your infrastructure on your schedule, it's indexing everyone's.

The second approach - the one SurfaceDiff takes - only ever monitors domains an account has explicitly added and verified ownership of, on a schedule you control, and diffs each new scan against the last one it actually ran. Nothing gets scanned without that verification step first. See how this compares to an internet-wide index like Shodan if you're trying to decide which one you actually need.

How SurfaceDiff does it

Each monitored domain gets scanned on a schedule - subdomains, DNS records, open ports, TLS certificates, and live web services. Every scan is normalized into one structured snapshot, diffed against the previous one, and only genuine changes become incidents: new hosts, new ports, changed certificates, services that disappeared. Review a finding once, with a reason, and it stops re-alerting until it actually changes again - and that review is kept, with who did it and when, not just reflected in the current dashboard state.

See what external attack surface monitoring for your own domains looks like in practice, or - if you manage this for many client domains rather than your own, common for hosting providers and agencies - see how shared-server monitoring and per-client access work.

Run a free scan to see what this actually finds on a domain you manage, check pricing if you already know you want ongoing monitoring, or see best practices for tips on reviewing incidents once you have some.