External Attack Surface Management
Find what is exposed before it becomes an overlooked risk
Discover internet-facing assets, validate ownership, assess observable exposure, and coordinate remediation through a workspace updated according to configured scan cadence.
MTX Attack Surface Management provides an outside-in view of domains, cloud endpoints, web applications, APIs, certificates, and exposed services that may be connected to the organization. The platform combines discovery with ownership validation, risk context, remediation workflows, and verification.
Based on authorized outside-in discovery. Ownership requires validation.
Illustrative MTX ASM interfaceUpdated by configured cadence
Surface changesReview queue
- Confirmed
- Requires validation
- Elevated exposure
Illustrative product data
Platform scope
A defined outside-in operating model
6asset categoriesDomains, networks, cloud, web, APIs, certificates
5operating stagesDiscover, validate, assess, remediate, verify
3ownership statesConfirmed, under review, unassociated
1connected exposure viewDiscovery, context, workflow, and change
Security operations
Turn external uncertainty into structured review
Select a challenge to see how the product supports evidence collection, context, and accountable action.
MTX product response
Incomplete asset inventory
- Why it matters
- Internet-facing assets may be created outside established inventory and change-management processes.
- Observable evidence
- DNS relationships, certificates, hosting context, and externally reachable services.
- Context required
- CMDB records, application portfolios, and owner confirmation.
- MTX capability
- Use authorized outside-in discovery to identify observable assets and compare them with confirmed inventory.
- Suggested measure
- Observed assets awaiting inventory reconciliation
Operating lifecycle
Move from observation to verified action
The lifecycle keeps discovery evidence distinct from confirmed ownership and remediation records.
Stage 1
Discover
Collect externally observable evidence within written authorization and approved scanning rules.
Discovery operates only within authorized scope and approved scanning rules.
Discover workspace
Illustrative product data
- Seed and related domains
- Subdomains and IP addresses
- Cloud endpoints
- Web applications and APIs
- Certificates
- Exposed services
- External relationships
Relationship intelligence
Investigate the observable attack surface
Filter a fictional relationship map, select an asset, inspect evidence, and record a local workflow decision.
Fictional asset relationship map
- Confirmed
- Under review
- Third-party
- Unassociated
Open text alternative for the relationship map
| Asset | Type | Relationship | Ownership | Priority |
|---|---|---|---|---|
| citizen.northstar-services.example | Web application | Observable relationship to root domain | Confirmed | Elevated |
| permits.northstar-services.example | Web application | Observable relationship to root domain | Confirmed | Standard review |
| api.northstar-services.example | API | Observable relationship to root domain | Under review | High priority |
| legacy-portal.northstar-services.example | Web application | Observable relationship to root domain | Under review | Critical review |
| files.northstar-services.example | Cloud endpoint | Observable relationship to root domain | Confirmed | Elevated |
| vendor-access.example | Third-party service | Observable relationship to root domain | Third-party | Standard review |
| test-api.example | API | Observable relationship to root domain | Unassociated | Informational |
| status.northstar-services.example | Digital service | Observable relationship to root domain | Confirmed | Standard review |
Illustrative product data
Discovery evidence
Build the external view from observable evidence
External observations can support an investigation, but they do not establish ownership, purpose, or internal sensitivity by themselves.
Evidence category
DNS relationships
- What it may reveal
- Related names and infrastructure patterns.
- What it cannot confirm by itself
- Ownership, business purpose, or authorization.
- Why validation matters
- Association remains a hypothesis until evidence is reviewed and an accountable party records a disposition.
- Investigation contribution
- Connects candidate assets for analyst investigation.
Asset inventory workspace
Reconcile discoveries with accountable inventory
Search, filter, and inspect fictional records. Externally observed assets remain distinct from confirmed inventory until validation.
| Asset name | Type | Ownership | Business unit | Environment | First observed | Last observed | Priority | Findings | Change | Assigned owner |
|---|---|---|---|---|---|---|---|---|---|---|
| Web application | Confirmed | Citizen Services | Production | 2026-05-14 | 2026-09-10 | Elevated | 1 | Certificate changed | Maya Chen | |
| Web application | Confirmed | Permitting | Production | 2026-05-16 | 2026-09-10 | Standard review | 0 | No material change | Leo Hart | |
| API | Under review | Digital Platform | Unknown | 2026-08-21 | 2026-09-10 | High priority | 2 | New service observed | Unassigned | |
| Cloud endpoint | Confirmed | Shared Services | Production | 2026-06-11 | 2026-09-10 | Elevated | 1 | Hosting context changed | Avery Singh | |
| Third-party service | Third-party | Procurement | Vendor hosted | 2026-06-23 | 2026-09-10 | Standard review | 1 | Certificate nearing expiry | Vendor Management |
8 records · Page 1 of 2
Illustrative product data
Ownership validation
Turn discovery into accountable inventory
Use confidence and supporting evidence to guide a human decision. Attribution support is not a definitive ownership decision.
- Asset discoveredRecorded
- Attribution evidence collectedRecorded
- Potential owner suggestedRecorded
- 4Owner review requestedCurrent step
- 5Ownership confirmed or rejectedPending
- 6Asset classifiedPending
- 7Monitoring scope updatedPending
Association confidence
72% · Moderate
Indicator, not a definitive ownership decision
api.northstar-services.example
- DNS relationship to approved root
- Certificate includes related hostname
- No confirmed inventory match
Local decisionAwaiting owner review
Illustrative product data
Exposure prioritization
Explain why an observation deserves attention
Prioritization supports analyst decisions and can be configured to the organization’s risk model. The workspace does not expose a proprietary scoring formula.
High priority
Illustrative product data
Finding ASM-204
Externally reachable management interface
A management-interface pattern is observable on a likely associated API endpoint. Ownership and intended access require validation.
Why this priority
External reachability, high asset criticality, and a possible trust relationship raise attention. Recorded controls reduce urgency, while moderate ownership confidence and absent exploitability evidence preserve analyst review.
Critical reviewHigh priorityElevatedStandard reviewInformational
External reachabilityObserved
Externally reachable during the latest authorized assessment
Observable conditionReview needed
Administrative-interface pattern requires access-control review
Exploitability evidenceNot established
No supported exploitability evidence is linked
Asset criticalityHigh
From configured application-portfolio context
Data sensitivityUnknown
Internal context has not been confirmed
Trust relationshipElevated
Service may connect to a privileged workflow
Compensating controlsRecorded
Access gateway evidence is linked
Ownership confidenceModerate
Owner review remains open
Exposure age34 days
Based on first and current observation
Remediation statusValidating
Finding has not entered owner remediation
Finding explorer
Review observations without overstating certainty
Sample findings distinguish what was observed from what remains unknown and what context is needed next.
Observation requiring review
Forgotten public portal
- What was observed
- An older portal remains internet-accessible after the related program changed.
- What remains unknown
- Current business purpose, data handling, and intended access model remain unconfirmed.
- Why it deserves review
- The service is reachable and its ownership is under review.
- Potential business context
- May relate to a retired citizen-services program.
- Suggested next step
- Confirm ownership and intended availability before selecting a response.
- Assigned team
- Attribution queue
- Current status
- Validating
Illustrative product data
Illustrative change timeline
See how the external footprint changes
Compare scheduled observations and workflow events to understand what appeared, changed, or was no longer visible.
ElevatedRemediation
Exposure no longer observed
citizen.northstar-services.example
Critical reviewFinding
Finding reopened after reassessment
legacy-portal.northstar-services.example
ElevatedRemediation
Remediation recorded
files.northstar-services.example
High priorityFinding
Finding assigned
api.northstar-services.example
Standard reviewOwnership
Asset ownership confirmed
status.northstar-services.example
Critical reviewExposure
Service became reachable
legacy-portal.northstar-services.example
High priorityDiscovery
New subdomain first observed
api.northstar-services.example
ElevatedHosting
Hosting provider changed
files.northstar-services.example
Standard reviewCertificate
Certificate changed
citizen.northstar-services.example
Illustrative product data
Remediation command center
Connect observations to accountable workflows
Simulate assignment, evidence, exception, and verification steps. Prototype data stays in browser memory.
| Finding | Asset | Priority | Owner | Ticket | Due | Status | Exception | Verification | Updated |
|---|---|---|---|---|---|---|---|---|---|
| legacy-portal.northstar-services.example | Critical review | Attribution queue | Local-104 | Sep 14 | Validating | None | Not ready | 2h ago | |
| api.northstar-services.example | High priority | App Security | Local-108 | Sep 18 | Assigned | None | Not ready | 5h ago | |
| vendor-access.example | Elevated | Vendor Management | Local-112 | Sep 22 | In progress | None | Awaiting evidence | 1d ago |
Illustrative product data
Integration architecture
Add enterprise context without replacing record systems
Configured integrations can contribute owner, criticality, control, inventory, and workflow context. Displayed system categories are potential connection points, not a supported-integration commitment.
Selected layer
MTX ASM platform
- Asset discovery
- Attribution support
- Ownership validation
- Exposure assessment
- Contextual prioritization
- Change monitoring
- Remediation workflow
- Verification
- Reporting
Role-based experiences
Put role-specific decisions in view
Select a role to preview the tasks and decisions presented in its illustrative workspace.
Illustrative product data
CISO workspace
External-footprint trends
Open decision view
Priority exposure
Review current queue
Unknown ownership
Open decision view
Aging findings
Review current queue
Business-unit accountability
Open decision view
Remediation progress
Review current queue
Analytics and recommended measures
Measure the operating program, not marketing outcomes
Sample figures demonstrate product views and do not represent MTX or customer results.
Illustrative product data
Assets observed159Illustrative measureIllustrative product data
New assets8Illustrative measureIllustrative product data
Changed assets17Illustrative measureIllustrative product data
No longer observed5Illustrative measureDiscovery by asset category
Illustrative product data
604530150
Domains
Services
Cloud
Web apps
APIs
Certificates
- Observed
- Confirmed
Text summary: observed counts are higher than confirmed counts in each category because ownership validation remains in progress.
Ownership disposition
Illustrative product data
166illustrative assets
- Confirmed: 116
- Under review: 29
- Unassociated: 7
- Third-party: 14
Confirmed: 116; under review: 29; unassociated: 7; third-party: 14.
Authorized scope and governance
Keep discovery and decisions within established rules
Discovery activities must follow written authorization, applicable law, provider policies, and established rules of engagement.
Control family
Discovery authorization
Configured per deployment- Approved domains
- Approved address ranges
- Approved subsidiaries
- Excluded assets
- Scan windows
- Permitted techniques
- Third-party restrictions
Deployment and adoption roadmap
Adopt the operating model in controlled phases
The roadmap identifies decision points without prescribing a fixed implementation schedule.
Phase 1
Define scope
- Identify seed domains
- Establish authorization
- Define exclusions
- Identify stakeholders
- Agree on asset categories
- Set initial measures
Product and services model
Separate platform capability from delivery support
ASM platform
- Authorized asset discovery
- Asset relationships
- Attribution evidence
- Ownership validation
- Exposure assessment
- Contextual prioritization
- Change monitoring
- Remediation tracking
- Verification
- Reporting
Implementation services
- Scope definition
- Authorization planning
- Discovery configuration
- Data-source integration
- Inventory reconciliation
- Workflow design
- Prioritization configuration
- Ticketing integration
- Training
- Deployment
Managed ASM services
- Discovery review
- Ownership research
- Exposure triage
- Analyst support
- Remediation coordination
- Reporting
- Program reviews
- Platform tuning
Capability evidence
Product maturity and operating evidence
| Capability area | Status |
|---|---|
| Outside-in asset discovery | Available |
| Ownership validation workflow | Available |
| Contextual priority configuration | Configured per deployment |
| Enterprise data-source connections | Configured per deployment |
| Local remediation workflow | Available |
| Managed analyst operations | Configured per deployment |
| Expanded relationship analytics | Planned |
| Reporting views | Configured per deployment |
Why MTX Attack Surface Management
Connect discovery to decisions and follow-through
Outside-in discovery
Identify externally observable assets and relationships within an authorized scope.
Ownership validation
Help teams determine which assets belong to the enterprise and who is accountable for them.
Contextual prioritization
Combine exposure evidence with available business and security context to support review.
Remediation accountability
Move validated findings into assigned workflows with status, evidence, exceptions, and verification.
Fictional product prototype. No live discovery, scanning, customer information, or network access.
Build a clearer view of your external footprint
Explore how MTX Attack Surface Management can support asset discovery, ownership validation, exposure prioritization, and accountable remediation.