Censys External Exposure Management
External attack surface discovery based on continuous internet-wide scanning.
Vulnerability Management
External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
Addresses 53 stories in our coverage in the last 90 days 8 products that provide it
What it is
Continuous discovery of everything your organisation exposes to the internet, including shadow IT, old test servers and systems of subsidiaries, with alerts when something new or risky appears.
How to value it
Many incidents start on a system the security team did not know existed. Attackers scan the whole internet within hours of a new exploit. EASM gives you the same view of your own perimeter first, so an emergency patch reaches every exposed system.
Questions to ask a vendor
- 1How does it discover assets: DNS, certificates, IP ranges, cloud accounts?
- 2Does it cover subsidiaries and acquired companies?
- 3How quickly does it flag a newly exposed system?
- 4Does it confirm exploitability, or only list open ports and versions?
For your risk register
- Risk
- Unknown internet-facing systems are exploited after a new vulnerability is published.
- Control
- Continuous external attack surface discovery with an owner for every asset.
- Owner
- Security operations lead.
- Measure
- Exposed assets without a known owner.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Detectify Surface Monitoring
Continuous discovery and testing of internet-facing subdomains and services.
Holm Security Platform
Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.
Outpost24 EASM
Discovery and risk assessment of internet-facing assets.
Cortex Xpanse
External attack surface discovery and remediation.
Attack Surface Intelligence
External attack surface management that discovers internet-facing assets and prioritises their exposures.
runZero Platform
Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.
watchTowr Platform
Continuous discovery of internet-facing assets, with automated testing for exploitable vulnerabilities.
Recent stories it addresses
188 stories in total- 13 Nov 2026Hackers exploit exposed GeoVision CCTV software to disable Defender and deploy cryptominers
Hackers exploit exposed GeoVision CCTV software to disable Defender and deploy cryptominers.
- 12 Nov 20262026-020: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and Gateway have 28 memory flaws, including a critical CVE-2026-120868 affecting all deployments.
- 12 Nov 2026New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
New N-central exploits target patched servers, enabling root RCE and Windows SYSTEM access.
- 11 Nov 2026ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know
Attackers are using AI-powered red teaming tools like ARTEX and CyberStrikeAI for autonomous offensive operations.
- 11 Nov 2026AI Hacking Frameworks Like ARTEX, PentAGI, and Agent Zero Found Running on Internet-Accessible Servers
AI hacking frameworks found exposed on internet-accessible servers.
- 11 Nov 2026Grok AI App Builder Exposes Over 35,000 Apps, Leaking Confidential Business Data and Passwords
Grok AI app builder exposes 35,578 public apps with confidential business data, passwords, and patient information.
- 9 Nov 2026Hackers abuse refrigeration controllers to send spam and route proxy traffic
Hackers exploit internet-connected refrigeration controllers for spam botnets and proxy services.
- 7 Nov 2026Inside ARTEX: AI Hacking Tools, Exposed Servers and South Korean Bank Breaches
ARTEX AI hacking tools used in South Korean bank breaches affecting 67k people and 2.2k corporations.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.