Attack surface management, connected.

Attack surface management is the continuous work of finding what an organisation exposes to the internet, judging what matters and reducing it. AttackSight, from FFV, does that work in one connected picture.

What is attack surface management?

An organisation's attack surface is everything an attacker could reach or learn about it from outside. That includes its domains, websites, servers, services and certificates. It also includes its people, its brand and any credentials already in circulation.

Attack surface management, or ASM, finds those things, keeps the record current, assesses what it finds and directs effort to what reduces risk most. The work is continuous because the surface is never still. Systems appear and disappear. Certificates change. People join and leave.

External attack surface management

External attack surface management, or EASM, works from outside the organisation, on what the internet can see. It is the attacker's starting point, so it is a sound place to begin.

It also finds what an internal inventory misses. AttackSight needs one domain your organisation owns, and builds the picture from there.

Why a list of findings is not enough

Most tools report findings in isolation. Severity, however, is a matter of context.

Take, for example, four items on a list: a lookalike domain, a publicly profiled head of finance, a mailbox that appears in a leak, and a remote access portal open to the internet. Each is moderate. Each waits its turn. Read together, they describe a way in.

AttackSight holds everything it learns in relation to everything else, so that reading takes a moment rather than a project. You can see which public sites share the server behind a finding, where one fix closes several exposures, and which of your people are both visible and already compromised.

What AttackSight brings together

Seven engines each add their own kind of knowledge to the same picture.

• Prism · Attack surface discovery. Your domains, systems, servers, services and certificates, kept current.
• Lens · AI host assessment. An experienced tester's judgement on every system: what is real, what is not, and why.
• Periscope · People and brand research. The people, brand and sector threats an adversary would study first.
• Infrared · Dark web exposure. Credentials and data already circulating where they should not be.
• Focus · AI remediation planning. Precise plans, each tied to the exposures it resolves.
• Spectrum · Reports and analytics. A reading of the whole picture for analysts, executives and boards.
• Beacon · Continuous monitoring. Keeps every connection current, and tells the right people when one changes.

What to ask of an attack surface management platform

These questions separate a record of findings from an account of risk.

• Does it show how exposures relate? AttackSight shows sites that share a server together, traces leaked credentials to the sign-in page they open, and ties each plan to the exposures it resolves.
• Are findings examined before they reach you? Each carries a verdict and the reasoning behind it. The same issue is not reported twice.
• Does it say what it does not know? Where a source is silent, AttackSight says so. A connection it infers is marked as likely, never shown as fact.
• Does the record stay current? Systems that no longer exist are retired, not counted. New systems, people and findings are marked as they appear, and the right people are told when something material changes.
• Can the result reach a board? One score from 0 to 100 with five parts, the same figure on every screen and report, with a history that shows where risk is heading.
• Is it confined to what you own? Assessment is limited to domains your organisation has established it owns, and each organisation's picture is visible only to those entitled to it.

Questions