The fundamental problem ASM solves is that organisations do not actually know what is exposed. Asset inventories maintained in CMDBs, spreadsheets, and finance systems are almost always incomplete. Development teams spin up cloud instances that never get decommissioned, marketing launches a subdomain for a campaign and forgets it, an acquisition brings inherited infrastructure, and a misconfigured storage bucket quietly becomes public. Attackers enumerate all of this automatically; defenders, without ASM, do not.
ASM platforms discover assets the way an attacker would — by enumerating certificate transparency logs, DNS records, scan data, and the open internet — and then assess each discovered asset for exposure. The output is a continuously updated, attacker's-view inventory showing open ports, running services, software versions, known vulnerabilities, misconfigurations, expired certificates, and exposed credentials. Crucially, ASM finds assets that nobody inside the organisation knows exist.
The distinction between attack surface management and vulnerability management is worth being precise about. Vulnerability management starts from a known asset and asks what is wrong with it; attack surface management starts from the internet and asks what assets exist at all. The two are complementary: ASM finds the unknown and the exposed, vulnerability management then tracks remediation across the known estate. Modern exposure management blends both with threat context to prioritise what is reachable and exploitable.
ASM is especially valuable for organisations with a large or dynamic footprint — multi-cloud environments, frequent M&A, distributed development teams, or heavy use of SaaS and third-party services. It is also a direct input into compliance: NIS2, DORA, and ISO 27001 all require organisations to know and manage their attack surface, and an up-to-date ASM inventory is the evidence auditors expect.
Passeca delivers attack surface management on the Rapid7 platform, with implementation, tuning, and ongoing operation as a managed service. A free ASM scan shows an organisation, in minutes, what the internet already knows about its perimeter — often surfacing exposures the internal team was unaware of. For continuous coverage, Passeca operates ASM as part of a broader exposure-management programme that also includes vulnerability management and dark-web monitoring.