EASM as a Closed Loop: Discovery, Rating, Remediation, Repeat

External Attack Surface Management only works as a closed loop. How Prismatic Perimeter discovers assets, rates them, feeds the decision engine, and shortens time-to-remediation from weeks to hours.

Tomáš Korcak (korczis) April 09, 2026 821 words

A vulnerability scan is not security. A report is not security. Security is the closed loop between discovering what you own, rating what matters, remediating what's broken, and proving it stayed fixed. EASM fails whenever any of those four edges break.

The four edges

┌─────────────┐ │ Discover │ └──────┬──────┘ ▼ ┌─────────────┐ │ Rate │ └──────┬──────┘ ▼ ┌─────────────┐ │ Remediate │ └──────┬──────┘ ▼ ┌─────────────┐ │ Verify │ └──────┬──────┘ │ └──── (loop back to Discover)

Most "EASM tools" are single-edge: they scan. They hand you a PDF. The remaining three edges are left to humans who then drift out of sync within a week.

Discovery: assets you forgot you owned

Discovery starts from a seed (domain, ASN, company name) and fans out across DNS, certificate transparency, WHOIS, reverse-DNS, and passive-DNS sources. Each finding carries provenance so downstream stages know how it was discovered:

%Asset{
  host: "forgotten-staging.example.com",
  source: :cert_transparency,
  first_seen: ~U[2026-04-09 03:14:00Z],
  tier: :t1,
  evidence: %{ct_log: "...", sha256: "..."}
}

The hard part is not finding new assets. The hard part is not forgetting old ones. Every asset discovered stays in the registry even after it disappears, because "gone" is a signal too.

Rating: not every finding is equal

An expired cert on marketing.example.com is not the same problem as an open Redis on prod-db. Ratings combine exposure, criticality, and context:

Exposure — can the internet reach it?
Criticality — does a business process depend on it?
Context — is the owning team on-call?

The risk score is computed per finding and fed into the decision engine as a sealed envelope — so the operator dashboard can sort "what to fix first" in real time instead of arguing in a meeting.

Remediation: tickets are a symptom

A ticket is an admission that the loop is broken. Prismatic Perimeter instead emits an intent — "this host should not expose port 6379" — and checks it on the next discovery pass. If the intent is satisfied, the finding closes automatically. If not, it reopens. No one manually updates status fields.

Verification: the loop must close

Every closed finding is re-tested on a cadence appropriate to its tier. T1 findings get re-verified hourly. T4 findings get re-verified daily. A finding that silently reopens is a louder signal than a finding that never closed.

NIS2 and why this matters now

Under NIS2, Czech critical-infrastructure entities owe regulators a defensible answer to "what do you own, and how do you know?" A closed-loop EASM is that answer. An Excel sheet is not.

Where to go next

Academy: EASM Development — build the loop end-to-end
Academy: Color Team Security — red/blue/purple workflows
Glossary: EASM, Attack Surface, NIS2, Threat Intelligence, Risk Score

Four edges. Close all of them or you do not have EASM — you have a scan.