WATCH layer
WATCH
Observe public-facing assets and clues from the outside.
05
live decision states stay connected
EN
ASM and EASM Capabilities
ASM and EASM capabilities for external attack surface visibility
KMayer Exposure Lens AI uses EASM to observe public-facing asset and service clues from the outside, then adds ASM context such as scope, ownership, business relevance, exclusions, and remediation direction when authorized evidence is available. Unknown assets remain unverified candidates until an owner confirms them. The page explains external attack surface visibility, not proof of compromise or unrestricted scanning.
Passive signals only
Evidence before inference
Owner-ready next steps
77
Confidence model
72
Surface coverage
4
Scope states
Operating Story
Why attack surface management needs scope and ownership memory
A single scan freezes scope. Continuous ASM/EASM context keeps recurrence, owner path, and timing connected.
snapshot replay
Static checks freeze the surface.
Point-in-time evidence can show a perimeter, but it cannot explain whether drift returned, improved, or moved to the right owner.
ASM / EASM OPERATING LENS
LIVE
04states tracked
Continuoussurface memory when monitoring is enabled
Owner-awarehandoffs
Known
Visible assets with clear business or ownership context.
Possible
Public clues that may connect to the organization after review.
Unknown
Signals that need owner validation before interpretation.
Excluded
Evidence that should not be treated as in-scope after review.
Trend line
How attack surface evidence changes over time
01
Pressure
61
Current pressure
Newly observed and expanding surface clues increase review pressure when scope, ownership, or business relevance remains unresolved.
02
Improvement
17
Verified improvement
Confirmed exclusions, ownership decisions, and resolved public conditions reduce uncertainty in the modeled attack surface.
03
Recurrence
4
Recurrence watch
A recurring surface clue reuses its earlier scope decision, attribution evidence, and owner history instead of restarting discovery.
04
Verification
8
Verification ready
Fresh evidence determines whether a clue remains unknown, becomes known, is excluded, or moves into an authorized review path.
Public surface clues retain scope
and recurrence history, with owner verification
required before deeper action.
Premium Verdict Core
How confidence and scope boundaries prevent false certainty
Unknown assets are treated as clues until ownership and authorization make deeper validation appropriate.
79
bounded score
signal
confidence
boundary
decision
Score boundary
limits visible
Confidence only moves forward when coverage, scope, and owner approval stay visible.
Confidence meter
77%
Evidence coverage meter
72%
External surface evidence with owner review required
Evidence coverage and confidence limits stay visible before the score moves forward.
Deeper validation waits for ownership, approval, and a separate safe scope.
Surface-aware
Scope-safe
Owner-mapped
ASM EASM Evidence Matrix
ASM and EASM evidence model
Answer Engine Brief for ASM and EASM Capabilities
Direct answers about ASM and EASM capabilities
Public exposure visibility, internal ownership context, CAASM boundary discipline, evidence limits, and the authorized path from signal to remediation queue remain distinct and reviewable.
01
Public surface
02
Owner context
03
Scope boundary
04
Authorized review
01
Direct answer
Short answer
The ASM and EASM capabilities in KMayer Exposure Lens AI show how external public evidence connects to scope, ownership, business relevance, and authorized review. EASM observes internet-facing clues from the outside. ASM connects those clues to assets, owners, scope, and remediation decisions. The page keeps passive evidence separate from private inventory, active testing, and CAASM-style verified sources.
02
Capability depth
What this page covers
This page covers external attack surface management, broader attack surface management context, and CAASM boundaries, plus exposure ownership, confidence limits, asset context, vendor clues, and authorized review without treating them as disconnected products.
03
Boundary clarity
What this page adds
It adds the missing boundary layer: how the Cyber Exposure Observatory observes drift, how security decision intelligence assigns action, and which signals still require approved customer context.
04
Safe narrative
Safe citation angle
The page connects the unified exposure platform and Exposure Lens AI capability map to safe commentary around ASM/EASM maturity, owner mapping, and passive public observation while avoiding breach claims and protection guarantees.
05
Research ideas
Research and benchmark ideas
Future non-sensitive research can compare public surface recurrence, owner assignment delay, scope confidence, and remediation and CTEM closure movement without exposing private asset inventory or customer-specific findings.
Decision Queue
From attack surface evidence to an owner-reviewed queue
Now
01
Separate known and unknown surface clues
Owner
Review evidence family and probable business owner.
Security owner
Next
02
Validate cloud or vendor association
Owner
Confirm whether the clue belongs in scope.
Cloud owner
Needs authorization
03
Connect internal inventory context
Owner
Use approved CAASM or inventory evidence only.
Asset owner
Monitor
04
Watch surface drift over time
Owner
Keep recurring public changes attached to owner memory.
Operations owner
Buyer questions
Buyer questions about ASM, EASM and CAASM
01
Question
EASM observes public-facing asset and service clues to understand external exposure and change. Vulnerability scanning tests systems for technical weaknesses and requires an authorized scope; the public KMayer view does not perform unrestricted scanning.
02
Question
EASM provides outside-in public visibility. ASM adds scope, ownership, business relevance, and remediation context. CAASM connects approved internal inventory and control data, so it requires customer-authorized sources rather than public inference.
03
Question
The state reflects available evidence and owner review. Known clues have confirmed context, possible clues have a plausible relationship, unknown clues remain unverified, and excluded clues have documented reasons to stay outside scope.
04
Question
Provider, DNS, certificate, and service relationships can suggest an ownership path, but KMayer keeps the association provisional until a responsible owner or approved internal evidence confirms it.
05
Question
An unknown clue should move forward when it is relevant to a business decision and public evidence cannot confirm ownership, control, or impact. Authorization provides the private context needed for a responsible conclusion.
06
Question
Scope memory preserves why a clue was classified as known, possible, unknown, or excluded. Later reviews can reuse that evidence and owner decision instead of restarting the same attribution work.
Frequently asked questions
ASM and EASM FAQ
01
Answer
A known domain, URL, IP range, netblock, business name, or other approved public identifier can establish the starting scope. Ownership and exclusions should be confirmed before deeper validation.
02
Answer
No endpoint agent or private credential is required for the bounded outside-in view. Internal inventory, CAASM context, authenticated connectors, and deeper checks require approved access and verified authorization.
03
Answer
Unconfirmed assets remain possible or unknown rather than being presented as owned. Source lineage, confidence, exclusions, and owner review determine whether a clue becomes known, monitored, or removed from scope.
04
Answer
Approved read-only connectors, trusted exports, APIs, or service workflows can route evidence into existing operations when enabled. Integration availability and fields are confirmed for the authorized engagement.
05
Answer
The public capability does not perform unrestricted active testing. Any active check or authenticated validation requires verified ownership, a defined target set, explicit authorization, and a separate safe scope.
06
Answer
Each relationship keeps its evidence, probable owner, business relevance, and authorization boundary. Third-party clues remain provisional until the responsible organization confirms ownership and review rights.
Footer bridge
Move from visible surface clues to the right authorized review path.
The page keeps outside-in evidence separate from internal certainty so ASM and EASM stay trustworthy.
