DedSec Security Research · 2026-10-14
Most security teams already own a vulnerability scanner. So the natural question when External Attack Surface Management (EASM) comes up is a fair one: *we already scan for vulnerabilities — what does this add?*
The answer is not a longer list of checks. It is the step that happens before any check runs at all. A vulnerability scanner tests a list of assets you give it. EASM finds the assets first — including the ones nobody remembered — attributes them to your organisation, and only then analyses them. The discovery step is the product. Everything else is downstream of it.
A scanner is a precise instrument pointed at a target you choose. You hand it a set of IPs, hostnames or URLs, it fingerprints each one, and it reports what it finds against those. Within its scope it can be excellent.
The weakness is structural, and it has nothing to do with the quality of the checks: a scanner is only ever as complete as the list it was given. If an asset is not on the list, it is not tested, and it is not missing from the report — it is simply invisible. The scanner cannot tell you about the thing you forgot to tell it about.
That is exactly the gap an attacker lives in. They were never given your inventory. They start from your domain and no access, enumerate subdomains, scrape certificate transparency logs and map your DNS to find everything you own — including the assets you forgot. The forgotten staging host, the marketing microsite a vendor stood up three years ago, the subdomain still pointing at a deprovisioned cloud bucket: none of these are on your scanner's list, because nobody remembers they exist. They are on the attacker's list, because the attacker built the list from the outside.
EASM inverts the starting assumption. Instead of beginning with a known inventory, it begins with a domain name and works outward the way an attacker would: enumerating subdomains, resolving infrastructure, fingerprinting live services, and attributing each discovered asset back to the organisation that owns it.
Attribution is the quietly difficult part. Finding a host is one thing; proving it is *yours* — rather than a shared-hosting neighbour, a third party that merely appears in your surface, or an unrelated service on the same range — is what turns a pile of observations into an inventory you can act on. Maphra attributes each asset back to your organisation, so the forgotten staging host shows up on your inventory before it shows up on theirs.
And because attack surface is not a document you produce once a year, discovery has to keep going. Maphra re-runs discovery on a schedule, diffs the result against the last known surface, and tells you what appeared, what changed and what quietly disappeared. A scanner run is a photograph. Continuous discovery is the difference between a photograph and a record of change.
None of this replaces exposure analysis; it makes it meaningful. Once an asset is discovered and attributed, Maphra fingerprints it and checks it for the things that actually get organisations breached: service versions, certificate and TLS posture, security headers, DNS hygiene and takeover-prone records. Every finding carries the raw response that produced it, retained per finding, so a second person can reach the same conclusion independently rather than trust a severity label.
This is where EASM and a conventional scanner start to look similar — both examine live assets for weaknesses. The difference is upstream. The scanner analysed the assets you knew about. EASM analysed the assets an attacker would find, which is a strict superset, and it did the work of discovering and attributing them for you.
There is a second category that no internal scanner reaches, no matter how complete its target list, because these exposures do not live on your infrastructure at all.
Often there is no exploit involved. A staff password from an unrelated breach still works. A look-alike domain harvests a credential from one of your customers. An impersonating application trades on your brand. These are attack paths against you and your users that never touch your network — so a tool pointed at your network cannot see them. Maphra monitors breach corpora for your domains and watches for look-alike domains and impersonating applications, because the perimeter is not where this part of the attack starts.
Discovery that finds more will, naively, produce more findings — and a team drowning in ten thousand findings fixes the wrong ones while the reachable critical stays open. So the output has to be ranked by something real.
Maphra deduplicates findings across scans, correlates them with exploit intelligence, and ranks by actual reachability rather than a theoretical severity score, then tracks each one through new, reopened and fixed with ownership, ageing and an SLA — not a re-issued PDF every quarter. A CVE only raises an alarm when it touches an asset you actually operate. The point of finding more is not to alarm you more; it is to make sure the thing an attacker would reach first is the thing you see first.
A vulnerability scanner remains a sensible instrument for assessing assets you already manage. But if you cannot say with confidence what you expose to the internet, no scanner will close that gap, because the gap is the inventory itself — and the inventory is precisely what EASM produces.
The short version: if you are shipping code and want the flaw caught before it ships, that is an application-security problem. If you have no reliable inventory of what you expose to the internet, that is an EASM problem — and it is the one an attacker solves first, whether or not you have.
See it against your own estate. Maphra needs nothing but a domain name — no agent, no credential, no network access. Book a walkthrough against your own surface rather than a canned demo, or start smaller with the free external attack-surface scanner, SSL/TLS checker and DNS checker.