{"id":48,"date":"2023-11-27T08:50:00","date_gmt":"2023-11-27T08:50:00","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=48"},"modified":"2025-06-19T09:10:10","modified_gmt":"2025-06-19T16:10:10","slug":"discovery-dont-let-the-wrong-definition-impact-your-risk-exposure","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/discovery-dont-let-the-wrong-definition-impact-your-risk-exposure\/","title":{"rendered":"Discovery: Don\u2019t Let the Wrong Definition Impact Your Risk Exposure"},"content":{"rendered":"\n

For external attack surface management<\/a> (EASM) technologies, the word \u201cdiscovery\u201d has as many shades of gray as there are crayons in a crayon box.\u00a0<\/p>\n\n\n\n

An accurate external asset inventory is a top priority for organizations reducing risk. Performed well, discovery provides visibility into a business\u2019s entire IT ecosystem of interconnected external assets. Performed poorly and discovery leads to a ripple effect of uncertainty, risk gaps, and wasted effort.<\/p>\n\n\n\n

Since defined in 2021 by Gartner, EASM has experienced rapid growth<\/a>, as much as 31% between 2021 and 2022, leaving many competing technologies claiming a piece of the asset discovery pie. Each vendor has their own definition, but not all lead to the same results.<\/p>\n\n\n\n

What is CyCognito\u2019s definition of Discovery?<\/h2>\n\n\n\n

At its most fundamental, \u201cdiscovery\u201d refers to the uncovering of the entire list of externally exposed digital assets (IP addresses and web applications, for example) owned by an organization.<\/p>\n\n\n\n

It then gets murky for many technologies. Spotting a single new asset in a known IP address range is <\/em>discovery, but it also isn\u2019t the use case that is needed (and expected) by IT security teams. <\/p>\n\n\n\n

Nor is it CyCognito\u2019s definition. What about assets within currently unknown IP address ranges, the ones tied to different divisions within your organization? What about assets within subsidiaries? What about discovering business context and evidence? Cloud assets? Everything is part of the definition and must be included.<\/p>\n\n\n\n

The right definition of discovery includes three elements: organizational discovery (to understand where to look), asset discovery (to do the finding), and context discovery (to uncover meaningful details). To summarize:<\/p>\n\n\n\n

Discovery \u2260 Asset Discovery<\/h5>\n\n\n\n
Discovery = Organization Discovery + Asset Discovery + Context Discovery<\/h5>\n\n\n\n

With discovery, automation is critically important. The owner of an asset discovery tool doesn\u2019t necessarily know or have access to the correct inputs to search for assets within all corners of your IT ecosystem. And since the external attack surface is continuously changing (on average 10.3% per month, from CyCognito State of External Exposure<\/a> research), this issue never goes away.<\/p>\n\n\n\n

Let’s look at each element in more detail.<\/p>\n\n\n\n

First: organizational reconnaissance<\/h2>\n\n\n\n

An automated, organic search workflow that starts with organizational reconnaissance builds the highest accuracy external asset inventory and richest context fidelity.<\/p>\n\n\n\n

An EASM must have a way of viewing an organization from the eyes of someone unfamiliar with it AND who has the goal to break into it. This is how an attacker finds the forgotten, unmanaged systems that lead to a breach and what your EASM must also do to beat cybercriminals at their own game.<\/p>\n\n\n\n

Organizational reconnaissance isn\u2019t easy to automate, but doing so is imperative if it is to be performed consistently and continuously. Like an attacker, the system needs to be able to read periodicals, SEC filings, Wikipedia, Crunchbase, press releases, Google search results, and much more to understand the scope of an organizational business structure. Did your Germany division just merge with a small supplier and now own all its assets? Attackers know this may be a way into the parent company and will capitalize on it. Often the only way you would know about it is by reading a press release, which is not something IT Security teams commonly have time to do.<\/p>\n\n\n\n

CyCognito starts with a \u201czero knowledge\u201d approach. Using machine learning (ML) and natural language processing (NLP) technologies CyCognito scrapes web pages, reads PDFs, and more, building a continuously updated graph data model that represents your organization\u2019s attack surface. Figure 1 illustrates this attack surface discovery approach that leaves no stone unturned and requires no effort from your IT security teams.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Figure 1. Organizational reconnaissance with CyCognito<\/em><\/p>\n\n\n\n

Want to see more about the decision? Every discovery choice includes what CyCognito calls a \u201chypothesis,\u201d which is a level of confidence in the chosen relationship and includes the supporting evidence for the claim.<\/p>\n\n\n\n

Second: asset discovery<\/h2>\n\n\n\n

Nearly all EASM products on the market today require seed information to begin, forcing the IT security team to manually enter IP ranges and domain names for the product to scan. It goes without saying that the list of domains and IP ranges must be continuously assessed and adjusted to ensure accuracy. Miss an IP range from a division you didn\u2019t know existed? It just takes one unmanaged asset with an exposure to provide a foothold into your network.<\/p>\n\n\n\n

CyCognito\u2019s asset discovery engine is natively integrated with its organizational reconnaissance engine. Once the organization is mapped, CyCognito then uses what it calls propagated discovery – each asset is used as a seed to discover new adjacent assets. These new adjacent assets are used to find more assets, and so on. In this way, CyCognito finds even the most obscure assets without human input or effort.<\/p>\n\n\n\n

Cloud assets are as important. The CyCognito cloud connector provides the most responsive view of often difficult-to-track ephemeral assets that reside in cloud service provider (CSP) infrastructure.<\/p>\n\n\n\n

And third: context discovery<\/h2>\n\n\n\n

Without context, the discovery process is incomplete. CyCognito discovery includes understanding what an asset is, where it exists in the network, its primary purpose, and more. <\/p>\n\n\n\n

CyCognito automatically uncovers meaningful, accurate context that IT Security teams can do something with. This context is used to make prioritization decisions and build accurate test payloads. Examples of context include:<\/p>\n\n\n\n