Practical Assessment
EASM Readiness Checklist
24 items across 6 categories to assess whether your organization has full visibility into its external attack surface, or critical blind spots that attackers will find first.
An incomplete view of your external attack surface is the #1 reason breaches succeed. This checklist helps you identify exactly where your blind spots are.
How to use this checklist
Go through each item and honestly assess whether your organization has this capability today. Each unchecked item represents a gap in your external attack surface visibility, and a potential blind spot that adversaries can exploit.
This checklist is designed for CISOs, security architects, and security engineering leads who need to evaluate their EASM maturity or build a business case for an EASM platform.
What This Checklist Covers
This assessment spans six core areas of external attack surface management. Each category represents a distinct visibility layer. Gaps in any one create exploitable blind spots. Use the grid below to see at a glance what each section addresses and how many items it contains.
Asset Discovery
5 items
Credential Exposure
4 items
Third-Party Risk
3 items
AI Exposure
4 items
Vulnerability Awareness
4 items
Operational Integration
4 items
Asset Discovery
Why it matters: You can't protect what you can't see. Asset discovery is the foundation of EASM: if your inventory is incomplete, everything downstream (risk analysis, prioritization, remediation) is built on a blind spot.
Complete inventory of all internet-facing domains, subdomains, and associated DNS records
Includes wildcard entries, parked domains, and domains inherited from acquisitions.
Visibility into every public IP address, open port, and running service
Covers IPv4 and IPv6, including assets behind CDNs and cloud load balancers.
Cloud resource tracking across all providers, including shadow IT
AWS, Azure, GCP, and smaller providers. Includes resources spun up outside IT approval.
Automatic discovery of assets from acquisitions, subsidiaries, and joint ventures
M&A activity is one of the largest sources of unknown attack surface.
Mobile app analysis covering published Android/iOS apps
Identifies hardcoded API keys, backend endpoint URLs, and debug configurations in release builds.
Credential Exposure
Why it matters: Leaked credentials are the fastest path to compromise. Attackers check breach databases, dark web forums, and code repositories before attempting any technical exploitation.
Monitoring for leaked employee credentials across breach databases and dark web marketplaces
Covers combo lists, credential dumps, and forum posts trading access to corporate accounts.
Scanning of public code repositories for exposed API keys and secrets
GitHub, GitLab, Bitbucket, including git history, not just current files.
Tracking credentials from stealer malware logs, paste sites, and underground forums
Stealer logs (Redline, Raccoon, Vidar) are a growing source of valid corporate credentials.
Real-time alerting when new credentials tied to your domains appear online
Speed matters: a credential leak has a short window before exploitation.
Third-Party Risk
Why it matters: Your attack surface extends to every vendor, SaaS tool, and external dependency your organization relies on. A misconfiguration on a vendor's side can expose your data.
Mapping of third-party SaaS tools and vendor integrations in your external surface
Includes OAuth connections, API integrations, and embedded third-party widgets.
Monitoring your vendors' external security posture for misconfigurations
Open ports, expired certificates, and known vulnerabilities on vendor infrastructure.
Tracking third-party JavaScript, external scripts, and CDN dependencies
External scripts loaded on your web properties are a supply chain attack vector.
AI Exposure
Why it matters: AI tools are creating exposure vectors that didn't exist two years ago. Data leaks through LLMs, exposed model endpoints, and shadow AI adoption are rapidly expanding the attack surface.
Awareness of which AI tools employees use with corporate data
ChatGPT, Copilot, Gemini, Claude. Each represents an unmonitored data flow to external APIs.
Monitoring for organizational data in LLM outputs and AI training datasets
Data ingested into public training sets is permanent and irrecoverable.
Scanning for exposed ML model endpoints, vector databases, and AI infrastructure
SageMaker, Vertex AI, self-hosted models, and vector DBs (Pinecone, Weaviate, Qdrant) accessible without authentication.
Assessment of AI-powered SaaS integrations for data flow and retention
CRM, support, and analytics platforms with AI features may send data to external model providers.
Vulnerability Awareness
Why it matters: Knowing what technology runs on your external surface determines how fast you can respond when a new vulnerability is disclosed. Without a technology inventory, you're flying blind during zero-day incidents.
Centralized technology inventory covering every framework, library, and service
Every technology version on every external asset, searchable and up-to-date.
Ability to identify affected assets within hours when a new critical CVE drops
When Log4Shell hit, organizations without a tech inventory took weeks. Those with one took hours.
SSL/TLS certificate expiration monitoring, weak cipher detection, and CT log surveillance
Expired or misconfigured certificates are a common attack surface finding.
Continuous checks for misconfigured cloud storage
Open S3 buckets, Azure blobs, and GCS objects, checked continuously, not quarterly.
Operational Integration
Why it matters: EASM is only valuable if findings reach the right people at the right time. Without integration into existing security workflows, discoveries sit in dashboards instead of getting fixed.
EASM runs continuously, not as a quarterly or annual scan
The attack surface changes daily. Point-in-time scans miss assets deployed between assessments.
Findings prioritized by exploitability and business context, not just CVSS
A CVSS 7.5 on a customer-facing API matters more than a CVSS 9.8 on an internal test server.
Alerts integrate with SIEM/SOAR, ticketing, and notification channels
Jira, ServiceNow, PagerDuty, Slack, Splunk, Sentinel. Findings should flow into existing workflows.
Attack surface metrics tracked over time and reported to leadership
Total assets, new assets, open findings, MTTR, and attack surface growth rate.
How to interpret your results
20+ items checked: Strong visibility
Your organization has solid external attack surface coverage. Focus on reducing mean time to detect (MTTD), improving remediation SLAs, and extending coverage to emerging areas like AI exposure.
10–19 items checked: Significant gaps
You have foundational coverage but material blind spots. Prioritize credential monitoring, third-party risk visibility, and continuous (not periodic) scanning. An EASM platform can close most of these gaps.
Under 10 items checked: Critical blind spots
Your external attack surface is largely unmonitored. Attackers have better visibility into your infrastructure than your security team does. EASM should be an immediate priority.