Attack Surface Management
Attack surface management (ASM), also known as External Attack Surface Management (EASM), is the continuous process of discovering, inventorying, and monitoring an organisation's internet-facing digital assets to identify shadow IT, forgotten subdomains, exposed cloud resources, and newly introduced vulnerabilities. Unlike periodic vulnerability scanning, which only covers assets you already know about on a fixed schedule, ASM runs continuously and discovers unknown assets as they appear. Precursor Security delivers managed EASM from £1,500/month with CREST-accredited analyst validation.
Most organisations have assets they do not know about: forgotten subdomains, developer test environments, third-party-hosted properties, shadow cloud infrastructure. Attackers find them routinely. We find them first. Our managed EASM service runs continuously, staffed by CREST-accredited analysts who validate every critical exposure before it reaches your team.
Continuous Attack Surface Management:
Analyst-Led Discovery
Annual penetration tests tell you what was exposed on one day of the year. Your attack surface changes every time a developer deploys a new service, an agency launches a campaign microsite, or a cloud resource is provisioned without a ticket. CREST-accredited continuous attack surface management closes the 364-day gap.
Continuous Discovery
Scans run continually. We automatically detect new subdomains, cloud buckets, marketing microsites, and developer test environments as soon as they spin up, using the same techniques attackers use such as subdomain brute-force, certificate transparency logs and passive DNS sources.
Shadow IT Detection
We find the assets your IT team does not know about: forgotten dev servers, staging environments left public, agency-hosted campaign sites, and unauthorised SaaS instances created outside managed accounts. Most mid-market organisations discover 15 to 35 previously unknown assets within 72 hours.
Cloud Attack Surface Management
Outside-in discovery of EC2, Azure App Services, GCP buckets, and exposed APIs regardless of whether they appear in your internal asset registry. Unlike CSPM tools, we discover cloud assets the same way an attacker does: from the outside.
Risk Prioritisation
Not all exposures carry equal weight. We filter out the noise and prioritise vulnerabilities based on actual exploitability, CVSS v3.1 scoring, and business context. You receive a ranked list of real risks, not 400 undifferentiated alerts.
Real-Time Alerting
Get notified via our real-time pentest portal the moment a critical exposure is detected. Open databases, expired certificates, and dangling DNS records are flagged within hours.
Analyst-Validated Findings
Every critical exposure is reviewed by a CREST-accredited team before it reaches your team. You receive prioritised, actionable findings with business context, not a raw data dump of automated alerts requiring your own triage.
External Attack Surface Risk Profile
Your attack surface changes every day. Annual penetration tests leave 364 days of blind spots. Continuous external ASM closes them.
Incidents from Unknown Assets
Of cybersecurity incidents occur due to unmanaged or unknown assets. Trend Micro, 2025
Detection Time
New assets detected within 24 to 48 hours of going live. Critical vulnerability checks run continuously across your entire perimeter.
Compliance Frameworks
Monthly reports satisfy ISO 27001 A.8 asset management, PCI DSS 11.2, NIS2, and DORA continuous monitoring requirements.
Controls
Engagement Workflow
Structured to minimise operational friction and maximise the value of the testing window.
Seed Discovery
We start with your main domains. Our engine recursively finds related assets via WHOIS, DNS, certificate transparency logs, and passive DNS, the same sources used in our OSINT Assessment methodology.
Fingerprinting
We identify technology stacks, software versions, and potential vulnerabilities (CVEs) running on every discovered asset across your entire external perimeter.
Analyst Validation
CREST-accredited analysts review every critical finding to rule out false positives. You receive confirmed, exploitable exposures with business context, not raw scanner output.
Continuous Loop
The process never stops. New assets are scanned immediately, resolved issues are re-tested automatically, and monthly reports provide audit-ready documentation of your external posture.
What You Get
Every managed ASM engagement includes the following deliverables, formatted for both security teams and non-technical stakeholders.
Reports delivered via encrypted portal with role-based access. Monthly PDF reports are structured for direct auditor submission.
When Do Organisations Commission ASM?
Managed attack surface management is typically triggered by one of these six scenarios. If any of these apply, you are in the right place.
Post-Incident Shadow IT Discovery
A subdomain breach or shadow IT incident has prompted the board to ask: what else don't we know about?
ISO 27001 Audit Gap
Your auditor flagged Annex A.8 asset management as a control gap and you need continuous evidence of external asset inventory.
Evaluating ASM Tools
You have trialled Censys, CrowdStrike Falcon Surface, or Microsoft Defender EASM but lack the headcount to manage daily alert triage.
Cloud Infrastructure Scaling
Developers are provisioning cloud resources faster than your asset register can track. You need outside-in visibility of what is actually exposed.
Supply Chain Monitoring
A client, partner, or regulator requires evidence that you monitor your external digital footprint and key third-party supplier exposure.
Board Visibility Mandate
The board or CISO wants a monthly metric for external exposure posture. You need a structured report, not a dashboard nobody checks.
Fixed Monthly Pricing
All tiers include 24/7 monitoring, CREST-accredited analyst validation, real-time alerting, and monthly audit-ready reporting. Annual contracts receive 15 to 20% discount. For project-based testing pricing, see our penetration testing cost guide.
Standard
Single brand, under 100 assets
Professional
Multiple brands, 100 to 500 assets
Enterprise
Multiple subsidiaries, 500+ assets, multi-cloud
Turn ASM Findings into
Active Threat Response.
ASM discovers your exposed assets. We feed those exact findings into our 24/7 Managed SOC and MDR service, building custom detection rules for your specific attack surface and continuously monitoring for active exploitation between discovery cycles.
Explore Defensive ServicesManaged Detection & Response
24/7 analyst-led monitoring tuned to the specific exposures ASM discovers in your perimeter.
External Network Pentest
Deep-dive manual testing of your internet-facing perimeter. ASM finds the surface; pentesting tests the depth.
OSINT Assessment
One-time deep reconnaissance of your digital footprint, credentials, and dark web exposure.
Continuous Security Testing
Human-led penetration testing integrated with your CI/CD pipeline for continuous assurance.
Full Penetration Testing Catalogue
Comprehensive penetration testing services tailored to your environment.
Internal Testing
Post-perimeter assessments targeting Active Directory, lateral movement, privilege escalation, and segmentation validation from inside your network.
The best time to test your defences is now.
Join the high-growth companies relying on Precursor for continuous offensive and defensive security.
Frequently Asked Questions
Common questions about this service, methodologies, and deliverables.
Attack surface management (ASM) is the continuous practice of discovering, cataloguing, and monitoring every internet-facing asset your organisation owns or is associated with, including domains, subdomains, IP addresses, cloud infrastructure, third-party-hosted assets, and shadow IT created without IT knowledge. The goal is to maintain a live, accurate inventory of your external footprint and to identify new vulnerabilities or exposures as they appear, rather than waiting for an annual penetration test to find them. External Attack Surface Management (EASM) focuses specifically on the externally visible attack surface: the portion attackers can reach without internal access. Unlike periodic vulnerability scanning, which only covers known assets on a fixed schedule, ASM runs continuously and discovers unknown assets as they appear. Most mid-market organisations discover between 15 and 35 previously unknown assets within the first 72 hours of onboarding.
Vulnerability scanning and attack surface management solve different problems. Internal vulnerability scanners only scan what you configure them to. ASM discovers assets you do not know exist (shadow IT, forgotten subdomains, marketing microsites, developer test environments). Scanners run on fixed schedules (weekly, monthly). ASM monitors continuously and alerts when new exposures appear within hours. Scanners do not discover assets created by third parties on your behalf (agencies, contractors, SaaS providers). Cloud infrastructure changes constantly. Scanners cannot keep pace with dynamic environments. Certificate transparency log monitoring for subdomain takeover risk is not available in traditional scanners. ASM is not a replacement for vulnerability scanning. It ensures you are scanning everything that matters, including assets you did not know existed.
Attack surface management (ASM) pricing typically ranges from £1,500 to £6,000 or more per month depending on scope and monitoring requirements. Standard ASM for small organisations (single brand, under 100 assets) averages £1,500 to £2,500 per month including continuous discovery, vulnerability detection, and real-time alerts. Mid-sized organisations (multiple brands, 100 to 500 assets) typically pay £2,500 to £4,000 per month. Enterprise ASM (multiple subsidiaries, 500 or more assets, cloud and on-premise) typically costs £4,000 to £6,000 or more per month. Pricing includes 24/7 monitoring, CREST-accredited analyst validation of critical findings, Slack/Teams/email alerting, and monthly reporting. Annual contracts typically receive a 15 to 20 percent discount. We provide fixed monthly pricing after initial asset discovery.
Self-service ASM platforms such as Censys, CrowdStrike Falcon Surface, or Microsoft Defender EASM require dedicated security staff to manage daily alert triage, tune false positives, and prioritise findings in context. For organisations without a dedicated ASM analyst (which is most mid-market teams) the tool generates more noise than signal. A managed EASM service from Precursor means CREST-accredited analysts handle discovery, triage, and validation on your behalf. You receive a prioritised list of real, confirmed exposures, not a raw feed of hundreds of automated findings. For most mid-market organisations, the total cost of a managed service is comparable to or lower than a SaaS platform licence plus the analyst headcount required to operate it effectively.
ISO 27001 Annex A.8.1 requires organisations to maintain an inventory of assets and ensure they are managed appropriately throughout their lifecycle. Continuous ASM directly evidences this control by maintaining a live, automatically updated inventory of all internet-facing assets. Monthly ASM reports provide auditable documentation showing what was discovered, when, and what action was taken. This is exactly the evidence auditors ask for. For PCI DSS, ASM supports Requirement 11.2 (identifying and monitoring all assets in scope) and Requirement 6.3 (managing vulnerabilities as they appear). For NIS2 and DORA, continuous monitoring of the digital perimeter is an explicit obligation. Monthly ASM reporting provides the documented evidence required during supervisory review. If your audit has flagged continuous asset management as a gap, talk to an analyst about your specific compliance requirements.