You cannot protect what you do not know you own. Attack surface management gives you a continuously updated inventory of your internet-facing assets, including domains, subdomains, cloud services, APIs, certificates, and exposed ports, and highlights the exposures attackers are most likely to use. WC1 sets up EASM for Singapore and Philippine organisations and, just as importantly, builds the remediation workflow that turns findings into fixes.
The problem: why external attack surface management matters
Internet-facing footprints grow faster than asset registers. Marketing launches a microsite, a project team spins up a test server in the cloud, an acquired subsidiary keeps its own domains, a vendor hosts a portal on your behalf. Months later, nobody remembers they exist, and they are running outdated software with default credentials.
Attackers scan the entire internet continuously. Forgotten assets, exposed remote access services, expired certificates, and misconfigured storage are among the most common initial access routes. Annual penetration tests only see what is in scope, so they rarely find what you did not know to include.
Who this service is for
Organisations with multiple brands, subsidiaries, or cloud accounts; regulated entities that must demonstrate asset visibility; and IT teams who suspect their CMDB does not reflect reality. It is especially relevant after mergers, rapid digital launches, or cloud migrations.
What WC1 delivers
Every engagement is scoped to your environment and risk. These are the building blocks we combine for external attack surface management:
- Asset discovery baseline: Seed-based discovery from your known domains, IP ranges, certificates, and cloud accounts to find the assets you own, including the ones nobody registered.
- Exposure detection: Identification of exposed services, outdated software, known exploited vulnerabilities, weak TLS, open storage, and leaked credentials tied to your assets.
- Attribution and ownership: Confirmation of which assets are genuinely yours, which belong to vendors, and which are impersonation, then assignment of a business and technical owner for each.
- Risk-based prioritisation: Ranking of exposures by exploitability, business criticality, and threat intelligence, so teams fix the few issues that matter first.
- Cyber asset attack surface management (CAASM): Optional correlation of external findings with internal asset sources such as CMDB, cloud inventories, EDR, and identity tools, for a single asset truth.
- Remediation workflow: Integration with ticketing and change processes, with SLAs by severity and verification that fixes actually closed the exposure.
How the engagement runs
1. Scope and seed
Agree the brands, entities, domains, and cloud accounts in scope, and collect seeds. Confirm rules of engagement and who approves takedown or shutdown decisions.
2. Discover and validate
Run discovery, remove false positives, and validate ownership with your teams. Produce the first inventory and exposure baseline.
3. Prioritise and fix
Rank exposures, open tickets with owners, and support remediation with configuration guidance. Track closure against agreed SLAs.
4. Operationalise
Set up continuous monitoring, alert routing, and monthly reporting. Connect EASM to vulnerability management and threat intelligence workflows.
5. Govern
Embed asset onboarding and decommissioning checks into your change and procurement processes so the surface stays under control.
Commercial shape follows the work: a fixed-scope assessment or implementation when the problem is well bounded, or a retainer when you need ongoing operation, tuning, and reporting. Coverage hours, response times, and responsibilities are written into the statement of work so there are no surprises.
Deliverables you can expect
- Validated external asset inventory with owners
- Exposure baseline report with prioritised findings
- Remediation tickets and SLA model by severity
- Continuous monitoring configuration and alert routing
- Monthly attack surface trend reporting
- Asset onboarding and decommissioning checklist
Platforms and tools we integrate
We work with leading EASM and exposure platforms and your existing tools, including Check Point Exposure Management (formerly Cyberint) attack surface management, Palo Alto Networks Cortex Xpanse, Microsoft Defender External Attack Surface Management, and CrowdStrike Falcon Surface, alongside open-source reconnaissance tooling for validation. Findings flow into Jira, ServiceNow, or your ticketing tool of choice.
WC1 is vendor-neutral: we integrate the platforms you already own before recommending anything new. Naming a product here describes technology we work with; it does not imply a partnership, reseller agreement, or vendor certification.
Singapore: regulatory and market relevance
The MAS TRM Guidelines expect financial institutions to maintain an accurate inventory of information assets and to manage vulnerabilities on internet-facing systems. MAS Notice on Cyber Hygiene requirements, such as network perimeter defence and timely security patching, are hard to evidence without external visibility. CII owners under the Cybersecurity Act and government vendors following IM8 face similar expectations. EASM gives you evidence that the perimeter you report is the perimeter you actually have.
Philippines: regulatory and market relevance
BSP Circular 982 and Circular 1140 require banks and supervised financial institutions to maintain asset inventories and manage vulnerabilities. Philippine agencies following DICT guidance, and organisations holding personal data under the Data Privacy Act, benefit from knowing exactly which systems are exposed, since NPC expects reasonable security measures proportionate to the data processed.
How this fits the rest of your security programme
External Attack Surface Management rarely stands alone. It works best alongside Continuous Threat Exposure Management, VAPT and Vulnerability Management, Cyber Threat Intelligence, Cloud Security and CNAPP. See the full catalogue on our Cybersecurity services page.
Related reading: IM8 and MAS TRM questions for cloud vendors.
Frequently asked questions
How is EASM different from a penetration test?
A penetration test is a point-in-time, in-depth test of a defined scope. EASM runs continuously and focuses on finding what exists and what is exposed, including assets that were never in a test scope. The two complement each other, and EASM findings often shape the next test scope.
Will discovery scanning disrupt our systems?
External discovery is non-intrusive and similar to what internet-wide scanners already do. Any active validation is agreed in the rules of engagement beforehand.
What happens when you find an asset nobody claims?
We investigate attribution. If it is yours, we help assign an owner and decide whether to secure or retire it. If it is impersonation, it moves to the brand protection and takedown workflow.
Can EASM cover our subsidiaries and vendors?
Yes, for subsidiaries you control. For vendors, we monitor what is publicly attributable to them as part of third-party risk monitoring, within legal and contractual limits.
How quickly will we see results?
Most organisations get a validated baseline within the first few weeks. The larger benefit comes from the remediation workflow and continuous monitoring that follow.
Next step
Share your main domains and cloud accounts and we will scope a discovery baseline, then show you what an attacker can see. Contact WC1 for a no-obligation conversation; we will tell you honestly if we are not the right fit.