[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:attack-surface-management":3},{"control":4,"products":25,"stories":90,"lessons":134,"related":159,"compare":171},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.","Continuous discovery of everything your organisation exposes to the internet, including shadow IT, old test servers and systems of subsidiaries, with alerts when something new or risky appears.","Many incidents start on a system the security team did not know existed. Attackers scan the whole internet within hours of a new exploit. EASM gives you the same view of your own perimeter first, so an emergency patch reaches every exposed system.",[11,12,13,14],"How does it discover assets: DNS, certificates, IP ranges, cloud accounts?","Does it cover subsidiaries and acquired companies?","How quickly does it flag a newly exposed system?","Does it confirm exploitability, or only list open ports and versions?","Risk: unknown internet-facing systems are exploited after a new vulnerability is published. Control: continuous external attack surface discovery with an owner for every asset. Owner: security operations lead. Measure: exposed assets without a known owner.",[17,18,19,20],"NIS2 Art. 21(2)(i): asset management","DORA Art. 8: identification of ICT assets","CIS Control 1: inventory of enterprise assets","ISO\u002FIEC 27001:2022 A.5.9: inventory of information and assets",{"name":22,"slug":23},"Vulnerability Management","vulnerability-management","2026-10-16T12:48:07.651852+00:00",[26,34,42,50,58,66,74,82],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png","censys-external-exposure-management","Censys External Exposure Management","https:\u002F\u002Fcensys.com\u002Fsolutions\u002Fexternal-exposure-management","External attack surface discovery based on continuous internet-wide scanning.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":38,"product_name":39,"url":40,"description":41},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"vendor_slug":43,"vendor_name":44,"vendor_logo":45,"product_slug":46,"product_name":47,"url":48,"description":49},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"outpost24","Outpost24","\u002Fvendor-logos\u002Foutpost24.png","outpost24-easm","Outpost24 EASM","https:\u002F\u002Foutpost24.com\u002Fproducts\u002Fexternal-attack-surface-management\u002F","Discovery and risk assessment of internet-facing assets.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xpanse","Cortex Xpanse","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xpanse","External attack surface discovery and remediation.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","attack-surface-intelligence","Attack Surface Intelligence","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fattack-surface-intelligence","External attack surface management that discovers internet-facing assets and prioritises their exposures.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png","watchtowr-platform","watchTowr Platform","https:\u002F\u002Fwatchtowr.com\u002Fplatform\u002F","Continuous discovery of internet-facing assets, with automated testing for exploitable vulnerabilities.",{"total":91,"last_days":92,"recent":93},157,38,[94,99,104,109,114,119,124,129],{"slug":95,"title":96,"published_at":97,"brief":98},"help-tds-linked-to-hotejka-as-20-000-cloudflare-pages-domains-host-tech-support--3d53c1","Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams","2026-10-15T14:11:36+00:00","Help TDS linked to Hotejka, hosting tech support scams on 20,000+ Cloudflare Pages domains.",{"slug":100,"title":101,"published_at":102,"brief":103},"sap-warns-of-maximum-severity-oauth2-ssrf-security-flaw-3b61a6","SAP warns of maximum severity OAuth2 SSRF security flaw","2026-10-13T13:51:02+00:00","SAP patches maximum-severity OAuth2 SSRF in Cloud SDK for Python; 20 flaws addressed in October update.",{"slug":105,"title":106,"published_at":107,"brief":108},"fbi-seizes-flax-typhoon-hacking-tools-linked-to-chinese-contractor-97d28a","FBI Seizes Flax Typhoon Hacking Tools Linked to Chinese Contractor","2026-10-08T23:09:07+00:00","FBI and DOJ seize domains and disrupt hacking tools used by China-linked Flax Typhoon.",{"slug":110,"title":111,"published_at":112,"brief":113},"attackers-hijack-gh-sl-and-as-registries-to-obtain-certificates-for-google-domai-d19160","Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains","2026-10-07T18:48:17+00:00","Attackers hijacked .gh, .sl, and .as domain registries to obtain unauthorized HTTPS certificates for Google domains.",{"slug":115,"title":116,"published_at":117,"brief":118},"south-korea-probes-bank-breaches-amid-suspected-ai-powered-attacks-d9fe3a","South Korea probes bank breaches amid suspected AI-powered attacks","2026-10-05T14:22:12+00:00","South Korea investigates breaches at major banks amid suspected AI-powered automated attacks.",{"slug":120,"title":121,"published_at":122,"brief":123},"waterisac-reckons-with-range-of-threats-after-summer-of-cyberattacks-bb9b65","WaterISAC reckons with range of threats after summer of cyberattacks","2026-09-30T10:00:00+00:00","WaterISAC addresses summer cyberattacks targeting water sector via exposed OT, PLCs, and integrator vulnerabilities.",{"slug":125,"title":126,"published_at":127,"brief":128},"baicells-nova-430h-ef19b5","Baicells Nova 430H","2026-09-29T12:00:00+00:00","Baicells Nova 430H vulnerability allows DoS via malformed messages.",{"slug":130,"title":131,"published_at":132,"brief":133},"cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw-f5dd20","CISA: Ransomware gangs now exploiting critical TeamCity flaw","2026-09-24T10:42:37+00:00","CISA warns ransomware gangs are exploiting a critical TeamCity vulnerability patched in July.",[135,139,143,147,151,155],{"slug":136,"title":137,"published_at":138},"help-tds-hotejka-exploit-20000-cloudflare-pages-domains-for-tech-support-scams","Help TDS & Hotejka Exploit 20,000+ Cloudflare Pages Domains for Tech Support Scams","2026-10-15T16:20:52.987+00:00",{"slug":140,"title":141,"published_at":142},"maximum-severity-sap-oauth2-ssrf-flaw-enables-unauthenticated-credential-theft","Maximum-Severity SAP OAuth2 SSRF Flaw Enables Unauthenticated Credential Theft","2026-10-13T14:20:19.556+00:00",{"slug":144,"title":145,"published_at":146},"fbi-dismantles-chinese-state-sponsored-hacking-infrastructure-targeting-us-critical-systems","FBI Dismantles Chinese State-Sponsored Hacking Infrastructure Targeting US Critical Systems","2026-10-09T00:20:22.236+00:00",{"slug":148,"title":149,"published_at":150},"hijacked-country-code-registries-used-to-issue-fraudulent-tls-certificates","Hijacked Country-Code Registries Used to Issue Fraudulent TLS Certificates","2026-10-07T20:20:53.85+00:00",{"slug":152,"title":153,"published_at":154},"critical-ssrf-flaw-in-sonicwall-sma1000-demands-immediate-patching","Critical SSRF Flaw in SonicWall SMA1000 Demands Immediate Patching","2026-10-07T12:20:24.151+00:00",{"slug":156,"title":157,"published_at":158},"ai-powered-attacks-expose-south-korean-banks-external-system-weaknesses","AI-Powered Attacks Expose South Korean Banks' External System Weaknesses","2026-10-05T16:21:47.382+00:00",[160,163,167],{"slug":23,"name":161,"problem":162},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":164,"name":165,"problem":166},"penetration-testing","Penetration testing and bug bounty","Someone friendly finds the holes before someone hostile does.",{"slug":168,"name":169,"problem":170},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",{"outpost24\u002Foutpost24-easm":172,"palo-alto-networks\u002Fcortex-xpanse":180,"watchtowr\u002Fwatchtowr-platform":198,"censys\u002Fcensys-external-exposure-management":206,"detectify\u002Fsurface-monitoring":213,"holm-security\u002Fholm-security-platform":219,"runzero\u002Frunzero-platform":226,"recorded-future\u002Fattack-surface-intelligence":235},{"hq_country":173,"also_provides":174,"reviews":175,"affected":179,"reported":179},"SE",[],[176],{"label":177,"url":178},"Gartner Peer Insights: Outpost24 Exposure Management Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Foutpost24-exposure-management-platform",0,{"hq_country":181,"also_provides":182,"reviews":183,"affected":196,"reported":197},"US",[],[184,187,190,193],{"label":185,"url":186},"AV-Comparatives EPR test 2026: Palo Alto Networks","https:\u002F\u002Fwww.av-comparatives.org\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FEPR_PaloAlto_2026.pdf",{"label":188,"url":189},"CyberRatings 2025 Q4 Enterprise Firewall Report: Palo Alto Networks follow-on","https:\u002F\u002Fcyberratings.org\u002Fresources\u002F2025-q4-enterprise-firewall-report-palo-alto-networks-follow-on\u002F",{"label":191,"url":192},"Gartner Peer Insights: PA-Series user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fpa-series",{"label":194,"url":195},"PeerSpot: Palo Alto Networks NG Firewalls user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fpalo-alto-networks-ng-firewalls-reviews",9,32,{"hq_country":199,"also_provides":200,"reviews":201,"affected":179,"reported":205},null,[],[202],{"label":203,"url":204},"Gartner Peer Insights: watchTowr Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fwatchtowr-platform",26,{"hq_country":181,"also_provides":207,"reviews":208,"affected":179,"reported":212},[],[209],{"label":210,"url":211},"Gartner Peer Insights: Censys Attack Surface Management user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fcensys-attack-surface-management",1,{"hq_country":173,"also_provides":214,"reviews":215,"affected":179,"reported":179},[],[216],{"label":217,"url":218},"Gartner Peer Insights: Detectify Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fdetectify-platform",{"hq_country":173,"also_provides":220,"reviews":222,"affected":179,"reported":179},[221],{"slug":23,"name":161},[223],{"label":224,"url":225},"Gartner Peer Insights: Holm Security Next-Gen Vulnerability Management user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fholm-security-next-gen-vulnerability-management",{"hq_country":181,"also_provides":227,"reviews":231,"affected":179,"reported":179},[228],{"slug":229,"name":230},"asset-inventory","Cyber asset inventory",[232],{"label":233,"url":234},"Gartner Peer Insights: runZero user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Frunzero-1617732381",{"hq_country":181,"also_provides":236,"reviews":237,"affected":179,"reported":244},[],[238,241],{"label":239,"url":240},"Gartner Peer Insights: Recorded Future Intelligence Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Frecorded-future-intelligence-platform",{"label":242,"url":243},"PeerSpot: Recorded Future user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Frecorded-future-reviews",3]