{"id":172,"date":"2024-01-09T15:05:00","date_gmt":"2024-01-09T23:05:00","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=172"},"modified":"2025-06-19T09:09:59","modified_gmt":"2025-06-19T16:09:59","slug":"no-room-for-doubt-why-security-testing-is-essential-for-your-external-attack-surface","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/no-room-for-doubt-why-security-testing-is-essential-for-your-external-attack-surface\/","title":{"rendered":"No Room for Doubt – Why Security Testing is Essential for your External Attack Surface"},"content":{"rendered":"\n

Behind the scenes, most external attack surface management<\/a> (EASM) products rely solely on basic reconnaissance technologies for asset discovery and risk detection.<\/p>\n\n\n\n

Unfortunately, this approach isn’t just a nice, simple way to understand exposure and risk; it’s actually risky, problematic, noisy, and painful.<\/p>\n\n\n\n

Let’s look at why.<\/p>\n\n\n\n

First, what is reconnaissance, and how is it used in EASM platforms?<\/h2>\n\n\n\n

From an attacker\u2019s perspective, reconnaissance or \u201crecon\u201d is just the passive or active investigation used to build a profile of a target. <\/p>\n\n\n\n

Passive recon<\/em> uses indirect techniques to build a target profile, making it exceedingly difficult to trace and thus heavily used by attackers. An EASM may use passive recon to expand an organization\u2019s domain name (called DNS enumeration<\/a>) to build a list of records. This provides insight into the external attack surface since the list of records leads to a list of IPs, illustrated in Figure 1.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Figure 1. Passive recon builds a list of domains in use by the target organization<\/em><\/p>\n\n\n\n

Active recon <\/em>techniques go one step further. Active recon interacts once with an asset, stopping after it initiates (but does not complete) a connection on a specific port (for example, port 25 for SMTP), as illustrated in Figure 2. Attackers use active recon carefully; since it is a direct interaction with a target, there is the risk of detection. An EASM uses active recon to scan the IP ranges uncovered using passive recon.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Figure 2. Active recon builds a list of exposed assets found inside the domains found by passive recon<\/em><\/p>\n\n\n\n

Most EASMs stop at reconnaissance because it provides just enough information to an end consumer to justify their claim to an \u201cattacker perspective.\u201d Unfortunately, the incomplete and low-confidence data forces IT security teams to manually filter out noise, quantify risk, prioritize issues, and build the context required for remediation.<\/p>\n\n\n\n

The external attack surface is no place for low-confidence data<\/h2>\n\n\n\n

Humans have a tendency to place unwarranted value on information that is presented to them numerically. This phenomenon is called false precision<\/a>: people assume that if something is presented as counted or calculated, it is also likely to be accurate and complete.<\/p>\n\n\n\n

Unfortunately, nothing could be further from the truth. Especially for EASMs that rely on recon as the sole means to discover assets and uncover risk.<\/p>\n\n\n\n

Here is why:<\/p>\n\n\n\n