Authorize scope
Confirm customer-owned domains, IPs, CIDRs, exclusions, timing, safety prerequisites, and the approved discovery method.
External Attack Surface Management
Turn approved external exposure into owned remediation and verified follow-through.
Threat Foundry EASM combines authorized discovery or imported evidence with asset, service, KEV, identity, business, ownership, due-date, remediation, change, and retest context.
Exposure operations
See which exposures need attention.
Review severity, ownership, observed changes and remediation work in the operating overview.
Exposure overview
Discovery boundary
Scope and control remain visible.
Active discovery runs only against explicitly approved customer-owned scope with current runner and safety prerequisites. The service does not promise exhaustive discovery, exploitability, or proof of compromise.
Discuss the operating boundaryEASM Customer Exposure Summary
Discover or import
Use saved scans, approved discovery plans, scanner integrations, or bounded files to build the evidence-backed exposure inventory.
Prioritize
Connect services, KEVs, EPSS, identity signals, business criticality, owners, recurrence, and evidence confidence.
Coordinate remediation
Assign owners and due dates, track finding state, suppression, tickets, cases, and the documented response.
Verify and report
Run focused authorized retests, preserve recurrence and delta history, and publish the approved customer exposure view.
Customer outcome
Evidence that can move into the next decision.
The service retains the agreed scope, review state, ownership, limitations, and follow-through instead of ending at an isolated deliverable.
Exposure inventory
Approved assets, observed services, posture evidence, changes, and current context.
Prioritized remediation
Risk, owner, due date, workflow state, suppression rationale, and next action together.
Retest and reporting
Focused verification, recurrence history, executive summaries, exports, and customer-safe publication.
Exposure context
Look beyond the vulnerability count.
Connect the external asset, its owner, the affected identity and the evidence needed for remediation.
Asset changes
Track what appeared or changed
Review external assets and services, change history and ownership alongside known exploited vulnerability findings and scanner evidence.
DNS and email posture
Review the domain configuration
Inspect recorded DNS and email-security posture with source freshness and affected domains. A configuration finding informs follow-up; it does not establish that a message was malicious.
Identity exposure
Keep the person and signal connected
Maintain watched identities, review incoming exposure signals and retain their provenance. Link relevant context into triage, cases and remediation without treating a signal as confirmed compromise.
Start with the workflow
Discuss managed external attack surface operations.
Bring the approved discovery scope, current asset sources, ownership model, remediation process, and reporting needs. We will map the first exposure outcome.
[s] = demonstration data