ASM: Map Your Attack Surface Before Attackers Do
Attack Surface Management: shadow IT, forgotten assets, Shodan, Censys, Subfinder, CT log certificates. Why continuous scanning beats point-in-time audits.
Your attack surface is larger than you think. According to a Mandiant study, 67% of organizations discover unknown assets during their first Attack Surface Management (ASM) exercise. Forgotten subdomains, exposed staging servers, undocumented APIs, public S3 buckets: attackers find them before you do.
What is Attack Surface Management?
ASM is the continuous process of discovering, inventorying, and monitoring all of an organization's internet-facing assets. Unlike a point-in-time vulnerability scan, ASM runs continuously and detects changes in real time: new subdomain, open port, expired certificate, accidentally exposed service.
Shadow IT: the enemy within
Shadow IT is the primary source of uninventoried assets. Every team that deploys a test server, every developer who creates a subdomain for a demo, every marketing department that configures a form on a third-party domain creates a potential entry point. Studies show that large enterprises have on average 30% of exposed assets unknown to their security team.
Discovery tools
Shodan and Censys
Shodan and Censys scan the entire Internet and index exposed services. By querying these engines with your IP range or domain name, you get an external view of what an attacker sees: open ports, service banners, software versions, TLS certificates.
Subfinder and subdomain enumeration
Subfinder aggregates dozens of sources (VirusTotal, SecurityTrails, Chaos, web archives) to discover all subdomains associated with a domain. Combined with httpx for HTTP validation, you get a complete and verified map of your web assets.
CT Logs (Certificate Transparency)
Certificate Transparency logs record every publicly issued TLS certificate. By monitoring CT logs via crt.sh, you immediately detect any new certificate issued for your domains, including certificates issued by third parties (phishing, typosquatting) or by internal teams without your approval.
Why continuous scanning beats point-in-time audits
A traditional security audit is a snapshot at a single point in time. But an organization's attack surface changes constantly:
-
Daily deployments: every push to production can expose a new service
-
Infrastructure rotation: ephemeral cloud instances change IPs and configurations
-
DNS changes: a modified record can redirect to an unprotected asset
-
Certificate expiration: an expired certificate can force an unencrypted HTTP fallback
The interval between audits (typically 6-12 months) is an exposure window that attackers exploit. Continuous scanning reduces this window to a few hours.
ThreatClaw and automated ASM
ThreatClaw natively integrates ASM tools in its 49 specialized skills:
-
Shodan: automatic querying of your IP perimeter, alerts on newly exposed services
-
Subfinder: continuous subdomain enumeration with new addition detection
-
httpx: HTTP/HTTPS validation of each discovered asset, technology fingerprinting (Wappalyzer-like)
-
crt.sh: Certificate Transparency log monitoring for your domains
-
Nmap: targeted port scanning on discovered assets
-
Nuclei: known vulnerability detection on exposed services
The agent orchestrates these tools automatically, correlates results, and triggers contextualized alerts. No manual configuration, no scripts to maintain.
ASM methodology in 5 steps
-
1. Discovery: enumerate all domains, subdomains, IPs, and services
-
2. Inventory: associate each asset with an owner and criticality level
-
3. Assessment: scan for vulnerabilities and misconfigurations on each asset
-
4. Prioritization: rank by real risk (CVSS + exposure + business criticality)
-
5. Remediation: fix or decommission at-risk assets
FAQ
What is the difference between ASM and a vulnerability scan?
A vulnerability scan analyzes known assets to find flaws. ASM starts by discovering unknown assets, then analyzes them. It is the difference between scanning a house and first finding all the doors you did not know existed.
Is ASM legal?
ASM of your own assets is perfectly legal. You are querying public sources (Shodan, CT logs, DNS) and scanning your own infrastructure. However, scanning assets that do not belong to you without authorization is illegal. ThreatClaw strictly limits itself to your declared perimeter.
How many unknown assets will I discover?
On average, organizations discover 20 to 40% additional assets during their first ASM exercise. For companies with numerous subsidiaries or a history of mergers and acquisitions, this figure can reach 60%.
Can ThreatClaw replace a dedicated ASM tool?
For most SMBs and mid-market companies, yes. ThreatClaw's ASM skills cover discovery, assessment, and continuous monitoring. For enterprises with tens of thousands of assets, a dedicated ASM tool (like Cortex Xpanse or Censys ASM) can complement ThreatClaw for massive discovery. Check our plans to evaluate the best approach.
Related articles
We detonated a live Phobos sample. Here is what it does, deleting shadow copies, killing the firewall, and the Sigma rule that catches it, validated across multiple samples with zero false positives.
Emotet, a notorious botnet and malware loader, remains a critical threat to SMBs. Learn how ThreatClaw’s new YARA rules help MSSPs detect and mitigate this persistent adversary.
Drokbk, a remote access trojan, evades defenses with keylogging and screen capture. ThreatClaw now detects it with zero false positives—protect SMBs and MSSP clients.
Dosia malware targets SMBs with obfuscation and tool transfer tactics. Learn how ThreatClaw’s new YARA rules help MSSPs detect and mitigate this threat effectively.