Attack Surface Management

Curriculum

About this path

Most attack surface work does not fail at the scanning step. It fails after: a tool returns a thousand assets and nobody can say which ones are actually owned by the company, which are actually reachable, and which single finding should move first. This path starts with that gap, not with the scanner, but with the question a scanner cannot answer on its own: whose is this, is it really exposed, and does anyone need to act on it today.

The curriculum was reviewed against a detailed sample of roughly 54 EASM and exposure-management job descriptions drawn from a wider 1,000 job-market scan. Exposure metrics and reporting, remediation workflow, and vulnerability validation or prioritisation appeared in every single listing sampled. Roughly three in four also asked for asset discovery, DNS/TLS/web fundamentals, EASM tooling, recon and enumeration, and shadow IT or asset attribution. Those market signals were used as a scope check, not as a keyword list, and the lessons stay grounded in what a real discovery pipeline has to prove at each step.

The first section defines what an attack surface actually is versus a CAASM inventory, then builds the DNS and email-authentication foundation, A/AAAA/CNAME/MX/TXT records, SPF, DKIM and DMARC, that almost everything downstream reads off of. The second section moves into ownership intelligence: WHOIS and RDAP, BGP/ASN correlation, reverse WHOIS pivoting on an email or organisation name, and favicon hashing and archived-page mining for assets that no longer advertise themselves. The third section is the largest: passive and active subdomain enumeration, certificate transparency logs, cloud storage discovery across AWS, Azure and GCP, indirect discovery through JavaScript and CSP analysis, and subdomain takeover, recognising a dangling CNAME before someone else claims it. The fourth section closes on verification: port scanning and service fingerprinting, and the harder question of what an "open" port actually proves about the service really answering it.

It assumes the same baseline as Open Source Intelligence (OSINT): comfort with a browser, files, and reading a technical record without a tool doing the reasoning for you. If DNS records and WHOIS lookups are new territory, Open Source Intelligence (OSINT) covers research fundamentals this path builds on, though it is not a hard requirement. You do not need an existing bug bounty or pentest background; the missions are built around public, disposable targets and archived data, not systems you would need special access to reach.

What you will learn

• Tell an inventory from an attack surface. Separate what a CAASM tool lists from what is actually reachable, owned and exposed right now, and explain why EASM and CAASM answer different questions.
• Read DNS and email authentication as evidence. Pull A/AAAA/CNAME/MX/TXT records, SPF, DKIM, DMARC and modern disclosure mechanisms apart, and use them to map real infrastructure rather than a resolved IP.
• Trace ownership across a domain portfolio. Use WHOIS/RDAP, BGP/ASN correlation and reverse WHOIS pivots to connect scattered domains back to one organisation, including the pre-GDPR record layer.
• Enumerate subdomains the way a real discovery pipeline does. Combine certificate transparency, search engine dorking, passive tools such as Subfinder, Amass, Shodan and Censys, and active brute-force or permutation scanning, and know when each is the right one to reach for.
• Recognise a subdomain takeover before an attacker does. Spot a dangling CNAME or orphaned NS delegation and its service-specific fingerprint, and explain what makes it actually exploitable rather than just stale.
• Find what indirect discovery surfaces. Pull assets out of JavaScript files, CSP headers and cloud storage buckets across AWS, Azure and GCP that active scanning alone would miss.
• Verify a service instead of trusting the scan. Explain what an "open" port actually proves, make a service prove its own identity, and read the network layer and TLS/HTTP evidence rather than the banner alone.
• Turn an asset list into a remediation queue. Prioritise findings the way the market data shows employers actually grade this work: validated risk and a named owner, not a raw count of open findings.

Who this path is for

• Security analysts and SOC staff who want to move into exposure management or vulnerability management without starting from a generic pentesting course.
• Students and career changers who have finished Open Source Intelligence (OSINT) and want to apply the same research discipline to an organisation's own infrastructure.
• Bug bounty hunters and pentesters who already run the tools but want the ownership, verification and remediation reasoning that turns a finding into something a company actually fixes.
• Security leads standing up an exposure management or EASM program who want to know what a good discovery-to-remediation workflow looks like before buying a platform.

Guides for this path

• Attack Surface Management (ASM) GuideAttack Surface Management (ASM) is the continuous process of discovering, cataloging, and securing all internet-facing assets that an attacker could target. Unlike traditional vulnerability management that focuses on known assets, ASM starts from the attacker's perspective, identifying assets your organization may not even realize are exposed.

Frequently asked questions