External Attack Surface Management (EASM) refers to the process of identifying, assessing, and mitigating the potential points of attack on an organization's external-facing assets, such as networks, systems, applications, and online presence. The "attack surface" refers to all the points and methods by which an attacker might try to gain unauthorized access to an organization's resources.

At EASM-UK we help our clients by conducting analysis of the Surface, Deep and Dark do deliver the following key areas of EASM:

1. Asset Discovery: Identifying and cataloging all external-facing assets, including websites, applications, servers, cloud instances, network infrastructure, Certiface details and Shadow IT.

2. Vulnerability Assessment: Conducting regular assessments to identify vulnerabilities in the external-facing assets. This involves scanning for known vulnerabilities and weaknesses that could be exploited by attackers.

3. Attack Surface Mapping: Creating a comprehensive map of the organization's external attack surface, including understanding how various assets are interconnected and the potential attack paths that could be exploited.

4. Brand and Domain Impersonations: Discover

   Domain and brand impersonations which are tactics used by malicious actors to deceive individuals or organizations by mimicking legitimate domains or brands.

5. Compromised Credential & Data Leaks:  Discover

   Compromised credentials (such as usernames and passwords) that have been stolen, leaked, or otherwise obtained by unauthorized individuals or parties.

6. Social Media Attack Surface: Social media platforms often serve as an extension of an organization's online presence. Companies use social media for branding, customer engagement, and marketing. Any social media account or page associated with the organization becomes part of the external attack surface. Attackers may exploit vulnerabilities in these accounts or use them as entry points for broader attacks.

7. Threat Intelligence & Threat Actor Reporting: Incorporating threat intelligence to understand current and emerging threats and Threat Actor Groups that may impact the external attack surface. This helps in proactively addressing potential risks.