Key Takeaways
- Continuous attack surface management means discovering, inventorying and reducing every asset an attacker could reach, including the ones your team does not know about.
- External attack surface management (EASM) is the outside-in part of attack surface management, finding internet-facing assets the way an attacker would.
- Continuous threat exposure management (CTEM) is a five-stage program introduced by Gartner, not a product, and attack surface management feeds its Discovery stage.
- In the Verizon 2026 Data Breach Investigations Report, exploitation of vulnerabilities was the most common way attackers got in, at 31% of breaches.
- Microsoft 365 Business Premium gives access to Microsoft Security Exposure Management, but asset-level external discovery needs a separate Microsoft Defender External Attack Surface Management subscription.
It is easy to lose track of what you have put online: a forgotten subdomain, a test server left running, a VPN that missed a patch. Attack surface management (ASM) finds those systems before attackers do, and two related terms now overlap with it: external attack surface management (EASM) and continuous threat exposure management (CTEM). This guide explains each one, how they fit together, and how to put them to work with tools many Microsoft 365 customers can already access.
What Is Attack Surface Management?
Attack surface management (ASM) is the continuous process of discovering, inventorying, monitoring and reducing every asset an attacker could use to get in, including the ones your team does not know about. Your attack surface is every system, account and connection an attacker could target. Microsoft’s definition of attack surface management makes the same point: it covers assets on-premises, in the cloud and outside your network, whether you know about them or not.
For most organisations, the attack surface has four parts:
- External: domains, public IP addresses, websites, web applications, VPNs and remote access gateways.
- Cloud and SaaS: cloud tenants, storage, and the software-as-a-service (SaaS) apps your staff sign into.
- Identity: user and service accounts, tokens and app permissions, the layer that identity threat detection and response watches for misuse.
- Third-party: supplier and partner connections into your environment.
The attack surface never stays still. New cloud services go live, test systems get forgotten, acquisitions bring in unfamiliar domains, and certificates expire. Attack surface analysis, the step where you review that inventory for exposures, only works if the inventory is complete.
The gaps matter. In the Verizon 2026 Data Breach Investigations Report, exploitation of vulnerabilities was the most common way into breaches at 31%, ahead of credential abuse at 13%.
Attack surface management is also not the same as attack surface reduction rules in Microsoft Defender. Those rules block risky behaviour on individual devices, while ASM finds and reduces what is exposed across the whole organisation.
What Is External Attack Surface Management (EASM)?
External attack surface management (EASM) is the part of attack surface management that looks at your organisation from the internet inward. It discovers the domains, IP addresses, hosts and web applications an attacker can see without any inside access.
EASM tools start from a few assets you already know, called seeds, and map outward to everything connected to them. In Microsoft Defender External Attack Surface Management (Defender EASM), seeds can be domains, IP blocks or addresses, hosts, autonomous system numbers (ASNs), email contacts and WHOIS organisation data, according to Microsoft’s guidance on the external attack surface management initiative. This attack surface mapping step is what surfaces assets missing from your own records.
EASM typically turns up:
- Forgotten subdomains that still resolve to live servers.
- Staging and development servers left open to the internet.
- Exposed admin panels and remote login pages.
- Expired or misconfigured certificates.
- Assets left over from old marketing campaigns or acquisitions.
Exposures like these are found in real environments. In one CyberQuell engagement, an outside researcher reported a misconfigured development server that exposed cloud credentials because it was running in debug mode. The investigation found no unauthorised access, the server was shut down and every credential was rotated. One of the long-term fixes was automated scanning for exposed development services, which is the job external discovery does continuously.
EASM is also different from cloud security posture management (CSPM). CSPM checks how your cloud is configured from the inside, while EASM checks what is visible from the outside.
What Is CTEM, and How Is It Different From ASM?
Continuous threat exposure management (CTEM) is a five-stage program, introduced by Gartner, for continuously finding, prioritising, validating and fixing security exposures. Attack surface management is one of the capabilities that feeds it: ASM tells you what is exposed, and CTEM decides what to do about it and makes sure it gets done.
CTEM is a way of running security work, not a tool you install. Products marketed as “CTEM platforms” cover parts of the program, but none of them replace the decisions your team makes about scope, priorities and ownership.
Microsoft built its own platform around the same idea. Microsoft states that the exposure graph in Microsoft Security Exposure Management covers devices, identities, cloud assets and external attack surfaces, and that it aligns with Gartner’s CTEM approach.
CTEM is also different from a security information and event management (SIEM) tool. CTEM reduces exposures before an attack happens, while a SIEM detects attacks in progress from log data.
The terms overlap enough that they are easiest to understand side by side.
Mapping what your organisation exposes to the internet is the first step. Book a call with CyberQuell to get a free security assessment of your exposed systems and a prioritised fix list your team can act on.
How ASM, EASM, CAASM, CTEM and Vulnerability Management Compare
ASM finds what you have exposed, and EASM is the internet-facing part of that search. Cyber asset attack surface management (CAASM) builds an inventory from tools you already run, vulnerability management finds weaknesses on assets you already know about, and CTEM is the program that makes sure fixes happen.
Most organisations need both the CAASM and EASM views, because each catches what the other misses. Your internal tools cannot report a server they have never seen, and an external scan cannot see the laptops and accounts behind your firewall.
Once an asset is in your inventory, the next question is which of its weaknesses to fix first. That decision is covered in our guide on how to prioritise vulnerabilities by exploit likelihood. If you are deciding between scanning for weaknesses and testing whether they can be exploited, see vulnerability assessment vs penetration testing.
What Are the Five Stages of CTEM?
Gartner’s CTEM framework has five stages that repeat in a cycle: Scoping, Discovery, Prioritisation, Validation and Mobilisation. Each stage hands its output to the next, and the last stage feeds back into the first.
- Scoping: Decide which part of the business the program covers first. For a 50 to 500 person company, start narrow with one area, such as internet-facing systems or your Microsoft 365 tenant, rather than trying to cover everything at once.
- Discovery: Find the assets and exposures inside that scope. This is where attack surface management and EASM do the work, turning up unknown systems alongside the weaknesses on known ones.
- Prioritisation: Rank what you found by real-world risk and business importance, not by raw severity score alone. An exposed server that holds customer data ranks above a test machine with the same flaw, which is why asset criticality matters at this stage.
- Validation: Confirm that an attacker could actually use the exposure. Penetration testing and attack path analysis both answer this question, and they stop your team from spending effort on issues that cannot be reached.
- Mobilisation: Name an owner for each fix, agree a deadline and re-check that the exposure is closed. This is the stage where most programs stall, because findings sit in a report without anyone accountable for them. Building security assessments that actually lead to remediation is how you get past it.
The cycle then starts again, because your attack surface changes every week. New services, accounts and suppliers appear, and each round of Scoping and Discovery picks them up.
How to Do Attack Surface Management With Microsoft Defender and Exposure Management
Microsoft customers can manage their attack surface in Microsoft Security Exposure Management, which Microsoft 365 Business Premium gives access to, and add Defender EASM when they need asset-level discovery of what is visible from the internet. The pieces fit together like this:
- Exposure Management, in the Microsoft Defender portal: builds a unified inventory across devices, identities, cloud and external assets, drawn from the Defender workloads you run. Its Monitor Exposure view shows internet-exposed resources, and its attack paths highlight choke points where many routes to a critical asset meet.
- The external attack surface initiative: offers two options. A pre-built footprint gives high-level metrics with no Defender EASM subscription, if Microsoft has a footprint for your organisation. Full integration with Defender EASM adds asset-level detail.
- Defender EASM: you add seeds, run discovery and review the resulting inventory. It is a separate Azure service, and Microsoft prices Defender EASM per asset per day, with a 30-day free trial on each new resource.
- Microsoft Defender for Cloud: Azure customers on the Defender CSPM plan already get the Defender EASM integration inside Defender for Cloud without a separate Defender EASM licence.
- Microsoft Defender Vulnerability Management: assesses and fixes weaknesses on the assets you already know about, inside Exposure Management.
- Microsoft Sentinel: the security information and event management (SIEM) platform where your security operations centre (SOC) watches for attacks. With Microsoft Sentinel monitoring in place, alerts on newly exposed assets get triaged instead of sitting unread.
What Business Premium Covers, and What It Does Not
Microsoft 365 Business Premium is one of the licences that give access to Exposure Management, so a 50 to 500 person company can open the inventory, initiatives and attack paths today. What appears there depends on which Defender products feed it. Microsoft’s Exposure Management prerequisites say full value needs Defender for Cloud with CSPM enabled and Defender Vulnerability Management. Cloud posture needs the Defender CSPM plan, and finding a forgotten internet-facing server needs Defender EASM.
Attack Surface Management in the UAE and UK
In the UAE and UK, attack surface management supports both security and compliance, because regulators and national cyber agencies expect organisations to know what they expose to the internet.
UAE: Remote access is a large part of the attack surface for organisations in Dubai, Abu Dhabi and across the Emirates. In March 2026, the UAE Cyber Security Council reported that around 38% of modern cyberattacks target remote work infrastructure such as home devices and VPNs. Compliance points the same way. The UAE Information Assurance Standards, the framework behind National Electronic Security Authority (NESA) compliance, include an asset management control family that expects an inventory of information assets with a named owner for each. External discovery finds the internet-facing assets missing from that inventory, which is a common gap in any NESA compliance checklist review. CyberQuell also runs security assessments for UAE organisations that start with this external view.
UK: The National Cyber Security Centre (NCSC) runs a free Early Warning service that alerts UK organisations to vulnerable services and open ports on the IP addresses and domains they register. It relies on threat feeds rather than scanning your network itself, and it only covers what you register. It will not find assets you do not know about, and that is the gap EASM fills.
How to Start Attack Surface Management in 30 Days
A small team can start attack surface management in about a month: list what you know, discover what you do not, close the riskiest exposures, then set a review cycle.
- Week 1, list what you know. Write down your domains, public IP ranges, cloud tenants and SaaS apps. These become your discovery seeds.
- Week 1, run external discovery. Use Defender EASM, the pre-built footprint in Exposure Management, or a partner offering security assessment and remediation services.
- Week 2, reconcile the results. Compare what discovery found with your own list. Give every unknown asset an owner or shut it down. Ownership stays with you even when a provider runs your monitoring, which is why it helps to know who owns asset inventory in an MSSP relationship.
- Week 2, close exposed management interfaces. Take Remote Desktop Protocol (RDP), Secure Shell (SSH) and admin panels off the open internet. The Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive (BOD) 23-02 gives US federal agencies 14 days to do this or put them behind zero trust access controls, a sensible bar for any organisation.
- Week 3, lock down remote access. Require multifactor authentication (MFA) on every VPN and remote access gateway.
- Week 3, hand off the rest. Pass remaining findings to vulnerability management, each with an owner and a deadline.
- Week 4, confirm and repeat. Re-scan to confirm the fixes, then set an attack surface monitoring cadence. For reference, BOD 23-01 requires US federal agencies to run automated asset discovery every 7 days.
Final Thoughts
Your attack surface changes every week, as new services go live and old ones are forgotten. Attack surface management shows you what changed, and CTEM makes sure the exposures that matter get fixed, but neither reduces risk until every finding has an owner and a fix date. Book a call with CyberQuell to see what attackers can see today and get a prioritised plan your team can close out. UAE organisations can start with our security assessments for the UAE.
.png)
