Blog
Exposure management vs attack surface management
Three terms, one shared word, and a market that swapped labels twice in four years. Attack surface management was the category to buy in 2021. By 2024 most of the same vendors were selling exposure management, and by 2025 Gartner was signalling that the older labels would be absorbed into broader platforms. The underlying capabilities changed far less than the names did, so it is worth being precise about what each term covers and where it stops.
Three definitions
External attack surface management, EASM, is outside-in discovery. An EASM tool looks at your organisation from the internet with no credentials and enumerates what an attacker’s reconnaissance would find: domains and subdomains, certificates, exposed IPs and services, cloud storage, code repositories, leaked credentials, third-party pages carrying your brand. Its defining question is “what do we have on the internet that we did not know about?”
Cyber asset attack surface management, CAASM, is inside-out inventory. A CAASM tool connects by API to the systems you already run (scanner, EDR, cloud accounts, identity provider, CMDB, MDM) and reconciles them into one view of every asset, with the gaps between sources made visible. Its defining question is “what do we own, and is each thing covered by the controls we think it is?”
Exposure management is the program that CTEM describes, and the tool category Gartner now calls exposure assessment platforms. It takes discovery from wherever it comes, EASM and CAASM included, ranks exposures by exploitability and business impact, validates the top ones, and drives remediation. Its defining question is “which exposures would an attacker actually use, and are they fixed?”
The first two are discovery techniques. The third is a five-stage cycle, of which discovery is one stage. That asymmetry is the whole distinction.
Where each one ends
EASM ends at the perimeter and at discovery. It sees the forgotten subdomain and the exposed admin panel, and it can tell you the service version and whether a known exploit exists. It cannot see the over-privileged service account behind the panel, it does not know which business process the host supports, and it does not test whether the exploit works against your configuration. Some EASM products offer light prioritisation, usually severity of the exposed service plus whether the asset was previously unknown. None of them validate or mobilise beyond alerts.
CAASM ends at inventory and control coverage. It is very good at “these 340 servers have no EDR agent” and “these cloud accounts are not scanned”. That is a discovery output and a useful one, because the exposures that hurt most are often on assets nobody was scanning. But CAASM does not look for exposures itself; it aggregates what other tools found. It has no view of attack paths, no validation, and its mobilisation is a ticket saying “install the agent”.
Exposure management ends where remediation capacity ends. It covers all five stages in principle, though in practice the platform category is strong on discovery and prioritisation and thin on validation, which is why Gartner tracks adversarial exposure validation as a separate category (Gartner, March 2025). Our tools guide goes through this stage by stage.
| Question | EASM | CAASM | Exposure management |
|---|---|---|---|
| Viewpoint | Outside-in, unauthenticated | Inside-out, via API to your own tools | Both, plus business context |
| What it finds | Unknown internet-facing assets and exposed services | Every asset you own, and coverage gaps | Exposures ranked by exploitability and impact |
| CTEM stages | Discovery (external) | Discovery (inventory) | All five, with validation often via a partner |
| Ends at | The perimeter | The inventory | Remediation capacity and scope |
| Typical owner | Security operations | IT asset management or security engineering | Vulnerability or exposure management program |
What Gartner did with the labels
Gartner’s 2024 Hype Cycle for Security Operations (Gartner, July 2024, subscriber research) placed EASM in the trough of disillusionment, citing enterprises that were unprepared to consume and operationalise the output, as summarised by IONIX. In the 2025 edition (Gartner), Gartner marked both CAASM and EASM as obsolete before plateau, as summarised by Axonius, which in Gartner’s vocabulary means the capability is expected to be absorbed into broader platforms before it reaches mainstream adoption as a standalone product.
That is an analyst’s view of the market, not a judgment on whether the capabilities are useful. Outside-in discovery and reconciled inventory are both still necessary; the point is that they are becoming features of exposure platforms rather than products you buy separately. The practical effect is that most EASM and CAASM vendors now describe themselves as exposure management, and buyers have to read past the label to find out which stages a product covers. The directory exists for exactly that reason.
Which one you actually need
If you cannot list your internet-facing assets with confidence, you need EASM, or the EASM module of whatever platform you have. It is the cheapest discovery win available and the usual first scope for a 90-day program.
If your scanner, EDR and CMDB disagree about how many servers you have, you need CAASM or equivalent reconciliation. You may not need a product; two exports and a join will get a first cycle through. What you need is the discipline of tracking the gap.
If you have both and still cannot say which ten exposures matter most this month, or whether any of them were tested, you need the rest of the cycle: prioritisation by attack path, validation, and mobilisation with named owners. That is exposure management, and it is mostly process with tooling underneath.
The common mistake is buying in the wrong order: an exposure platform before discovery is reliable, so the prioritisation runs on an incomplete inventory. The second common mistake is stopping after discovery, so the program produces a very complete list that nobody validates or fixes. Both look like activity. Neither reduces exposure.
A test for your current tooling
Take whatever you call your attack surface or exposure tool and ask it three questions. Can it show an internet-facing asset you did not know about last month? Can it show an asset you do know about that no scanner is covering? Can it show an exposure it proved exploitable, and the ticket that closed it?
Yes to the first is EASM. Yes to the second is CAASM. Yes to the third is exposure management. Most tools answer yes to one, and that is fine as long as you know which one and have a plan for the others.
Next
Read What is CTEM for the five stages in full, and use the vendor directory to see which stages a given product actually covers, whatever it calls itself.