Censys External Exposure Management
External attack surface discovery based on continuous internet-wide scanning.
Vulnerability Management
External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
Addresses 38 stories in our coverage in the last 90 days 8 products that provide it
What it is
Continuous discovery of everything your organisation exposes to the internet, including shadow IT, old test servers and systems of subsidiaries, with alerts when something new or risky appears.
How to value it
Many incidents start on a system the security team did not know existed. Attackers scan the whole internet within hours of a new exploit. EASM gives you the same view of your own perimeter first, so an emergency patch reaches every exposed system.
Questions to ask a vendor
- 1How does it discover assets: DNS, certificates, IP ranges, cloud accounts?
- 2Does it cover subsidiaries and acquired companies?
- 3How quickly does it flag a newly exposed system?
- 4Does it confirm exploitability, or only list open ports and versions?
For your risk register
- Risk
- Unknown internet-facing systems are exploited after a new vulnerability is published.
- Control
- Continuous external attack surface discovery with an owner for every asset.
- Owner
- Security operations lead.
- Measure
- Exposed assets without a known owner.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Detectify Surface Monitoring
Continuous discovery and testing of internet-facing subdomains and services.
Holm Security Platform
Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.
Outpost24 EASM
Discovery and risk assessment of internet-facing assets.
Cortex Xpanse
External attack surface discovery and remediation.
Attack Surface Intelligence
External attack surface management that discovers internet-facing assets and prioritises their exposures.
runZero Platform
Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.
watchTowr Platform
Continuous discovery of internet-facing assets, with automated testing for exploitable vulnerabilities.
Recent stories it addresses
157 stories in total- 15 Oct 2026Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
Help TDS linked to Hotejka, hosting tech support scams on 20,000+ Cloudflare Pages domains.
- 13 Oct 2026SAP warns of maximum severity OAuth2 SSRF security flaw
SAP patches maximum-severity OAuth2 SSRF in Cloud SDK for Python; 20 flaws addressed in October update.
- 8 Oct 2026FBI Seizes Flax Typhoon Hacking Tools Linked to Chinese Contractor
FBI and DOJ seize domains and disrupt hacking tools used by China-linked Flax Typhoon.
- 7 Oct 2026Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
Attackers hijacked .gh, .sl, and .as domain registries to obtain unauthorized HTTPS certificates for Google domains.
- 5 Oct 2026South Korea probes bank breaches amid suspected AI-powered attacks
South Korea investigates breaches at major banks amid suspected AI-powered automated attacks.
- 30 Sept 2026WaterISAC reckons with range of threats after summer of cyberattacks
WaterISAC addresses summer cyberattacks targeting water sector via exposed OT, PLCs, and integrator vulnerabilities.
- 29 Sept 2026Baicells Nova 430H
Baicells Nova 430H vulnerability allows DoS via malformed messages.
- 24 Sept 2026CISA: Ransomware gangs now exploiting critical TeamCity flaw
CISA warns ransomware gangs are exploiting a critical TeamCity vulnerability patched in July.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.