External attack surface management (EASM) is the continuous process of identifying, monitoring and reducing vulnerabilities in assets that can be reached from the internet. It shows an organization what an outside attacker can see.

How it works

• Discovery: starting from known domains and IP ranges, the process finds related subdomains, hosts, certificates and cloud services, including ones the IT team did not know about.
• Fingerprinting: lightweight connections identify which services, ports and software versions are running.
• Assessment: findings are checked for known vulnerabilities, weak configurations and expired certificates.
• Monitoring: repeated scans catch new assets and changes, and alert when something risky appears.

Why it matters for dark web monitoring

Attackers scan the internet constantly, and access to exposed systems is traded on criminal forums. Forgotten test servers, old login portals and shadow IT are typical entry points because no one patches them. EASM reduces the attack surface before it is abused, and dark web findings help set priorities: a host named in a leaked configuration file or an access sale should be checked first. Monitoring services map external assets as part of this process.

Sources: NCSC: External attack surface management (EASM) buyer’s guide, NIST CSRC Glossary: attack surface