Three terms get used as if they were interchangeable, and they are not. The category you need is decided by one question: which direction is the attacker coming from, and do you even know what you own yet? This is the plain-language version, without the acronym soup.
EASM starts from the outside with no access to your systems — typically just a domain name — and works out what an attacker can reach. The hard part, and the reason discovery is the product rather than a feature, is attribution: deciding which of the internet's reachable things are actually yours. A forgotten staging host, a parked domain, an acquired brand that was never consolidated, a DNS record pointing at a deleted cloud resource — EASM finds those first, attributes them back to you, and only then analyses them. You cannot defend an asset you do not know you own. Maphra is DedSec's EASM platform: Maphra discovers everything your organisation exposes to the internet, decides what actually matters, and proves exploitability — continuously, without an agent and without a credential.
ASPM works inside out. It connects to your source control and follows a flaw from the code and its dependencies, through the pull request, into the running application — SAST, DAST, SCA, secrets, IaC, container, Kubernetes and API testing under one deduplicated finding model instead of seven disconnected tools. The point is to catch the flaw in the pull request, while the author still has the context, rather than in the breach report. AppSecD is DedSec's ASPM platform: AppSecD runs SAST, DAST, SCA, secret detection, IaC, container, Kubernetes and API security from one platform — wired into Git, gated at the pull request, and managed through a real vulnerability lifecycle.
A classic vulnerability scanner checks known hosts or known code against a signature list and hands back a ranked pile of findings. That is useful, but it is a component, not a programme. It assumes you already have a complete, correct inventory — which is exactly the assumption EASM exists to challenge — and it generally stops at detection rather than proving reachability, deduplicating across scans, or carrying a finding through a real lifecycle to closure. A scanner tells you a port is open; EASM tells you that host is yours and exposed, and ASPM tells you the vulnerable line of code is reachable and gates the PR that would ship it.
The two directions overlap very little, which is why they are separate categories. See the platform comparison for a capability-by-capability view, or talk to DedSec Technologies about where to start.