EASM — External Attack Surface Management // MODULES

EASM — External Attack Surface Management

A map of what the organization exposes to the outside world, built from seeds the organization itself declares. The module discovers assets, records risk findings and maintains the graph of how each thing connects to the next — without ever touching the target intrusively.

Overview

The unit of work is the perimeter: a named scope inside the organization, such as “production” or “staging environment”. Each perimeter takes seeds of four kinds — CNPJ (Brazil’s corporate taxpayer ID), domain, IP range in CIDR notation and e-mail domain — and each kind triggers a different pipeline.

The CNPJ seed is the one that changes the game in Brazil. From it the platform queries the Brazilian federal tax authority’s public company registry, already indexed on the platform, finds the branches sharing the same root CNPJ, pulls the list of shareholders and flags high-risk business activity codes (CNAE) as findings. It is the path to discovering the subsidiary nobody on the security team knew existed — the classic merger-and-acquisition scenario.

Passive Discovery by Design

Collection is DNS lookups plus a TLS handshake. No payload is ever sent to the target. Three safety rules are applied before any result becomes an asset:

  • a private, loopback, link-local or multicast IP returned by DNS is discarded, so that the external inventory never leaks internal topology;
  • .local, .internal and .localhost domains are blocked at the input;
  • every run has ceilings — 500 assets, 1,000 findings, 500 relationships and 50 records per DNS type. A hostile or misconfigured zone cannot take ingestion down.

Discovered assets come in nine types (domain, subdomain, IP, e-mail, CNPJ-derived subsidiary, certificate, application, MX server and NS server), and each one carries the origin of its discovery: A/AAAA record, MX, NS, TXT, CNAME, certificate SAN, CNPJ lookup, leak correlation or manual entry. The graph connects assets through nine relationship types — resolves to, uses MX, uses NS, hosts, owns domain, has certificate, subsidiary of, found in leak and correlates with.

A Score That Explains Itself

An asset’s risk is the sum of the points of its open findings, capped at 100. An expired certificate is worth 25 points, an exposed development subdomain 20, a self-signed certificate 15, a certificate about to expire 10.

The practical consequence is that the number is auditable: you can point to exactly which findings make it up, and the score drops by itself as soon as a finding is closed, acknowledged or marked as a false positive. Each perimeter also keeps a count of assets, of open findings, of critical and of high findings, plus the average risk across its active assets.

Schedule

Certificate checks at 03:00 UTC, leak correlation at 04:00, risk recalculation at 05:00, finding archival at 02:00, and continuous monitoring every 6 hours — which re-checks DNS, tests ports 80, 443, 8080 and 8443 and compares against the previous snapshot to raise change findings, with a ceiling of 100 assets per run. Domain and CNPJ discovery, typosquatting detection and subdomain takeover hunting run on demand.

Capabilities

  • Twelve finding types, including subdomain takeover, typosquat candidate, shadow IT, exposed admin port and correlated leaked credential
  • Subdomain takeover detection via CNAME pointing to an unclaimed service, with signatures for GitHub Pages, Heroku, Fastly, Shopify, Zendesk, AWS S3, Azure, Bitbucket and Netlify
  • Typosquatting through dnstwist, capped at 500 variations per run, with a 3-second timeout per DNS lookup and controlled parallelism
  • Correlation with the Leaks module: an e-mail or domain asset that shows up in a leak fingerprint becomes a finding
  • A four-state finding lifecycle: open, acknowledged, false positive, remediated
  • A registry of bug bounty and VDP programs (BugHunt, HackerOne, Bugcrowd, Intigriti, YesWeHack, HackenProof)

Use Cases

  • Inventory the perimeter of a corporate group from its CNPJ, branches included
  • Find shadow IT: a development or staging subdomain reachable from outside
  • Get ahead of an outage caused by an expiring certificate, 30 days in advance
  • Prepare a pentest scope with the list of what is actually exposed

What the Module Does Not Do

  • It does not run vulnerability scans. It sends no exploits, tests no payloads and authenticates into no application.
  • It does not use CVSS or EPSS. The score is a sum of points per finding, not a third-party vulnerability rating.
  • It does not perform broad port scanning: continuous monitoring checks four web service ports.
  • It does not query Shodan, Censys or BinaryEdge, nor does it inventory cloud resources through the AWS, Azure or GCP APIs.
  • It does not discover internal assets — a private IP is a discard rule, not a temporary limitation.
  • typosquat_candidate means candidate. Confirming malicious intent is human analysis, and the follow-up runs through the Legal & Takedown module.

Integrations

  • Airflow (orchestration) and OpenSearch (finding history, ooda_easm_findings-*)
  • The Brazilian federal tax authority’s public CNPJ registry, indexed on the platform
  • dnstwist, for generating domain variations
  • OODA Leaks and OODA Search

SLA & Guarantees

Strictly passive collection · private IPs are never indexed · every score traceable back to the finding that produced it

Next Steps