External Attack Surface Management

Overview

External Attack Surface Management (EASM) is the Prismatic Platform's capability for continuously discovering, inventorying, and assessing an organization's externally visible digital assets. The EASM module -- implemented as Prismatic Perimeter -- provides security ratings on an A-F grading scale, automated asset discovery across domains, IP ranges, certificates, cloud resources, and services, and real-time compliance assessment against NIS2 and ZKB regulatory frameworks. It operates as a competitive alternative to commercial platforms such as BitSight, SecurityScorecard, and Black Kite, with the architectural advantage of deep integration into the Prismatic intelligence and epistemic verification stack.

EASM addresses a fundamental problem in modern cybersecurity: organizations cannot defend what they do not know they have. Shadow IT, forgotten subdomains, expired certificates, misconfigured cloud storage, and unmonitored third-party services all represent attack surface that adversaries actively enumerate and exploit. The Prismatic EASM module automates the discovery and continuous monitoring of this surface, transforming it from an unknown risk into a measured, scored, and managed security domain.

Security Ratings

A-F Grading System

The EASM module produces a security rating for every assessed entity using a dual-scale system: a letter grade (A through F) for executive communication and a numeric score (300-900) for granular tracking and trend analysis.

Ratings are computed from evidence-based findings across multiple assessment categories, each weighted according to its contribution to overall risk:

Rating Computation

# Security rating assessment
{:ok, rating} = PrismaticPerimeter.security_rating("target-organization.com")
# => %{
#   grade: :B,
#   score: 780,
#   industry_percentile: 72,
#   categories: %{
#     network_security: 82,
#     dns_email: 91,
#     certificate_management: 85,
#     application_security: 68,
#     cloud_infrastructure: 72,
#     compliance: 78
#   },
#   trend: :improving,
#   last_assessed: ~U[2026-02-14 10:30:00Z]
# }

Every score component carries provenance metadata tracing it back to specific discovered assets and identified findings, satisfying the Provenance Mandatory NABLA axiom.

Asset Discovery

Discovery Pipeline

The asset discovery process enumerates an organization's external attack surface through multiple reconnaissance techniques:

Seed Domain --> DNS Enumeration --> Certificate Transparency --> Port Scanning --> Service Fingerprinting --> Cloud Discovery --> Asset Inventory
     |               |                      |                       |                    |                       |                  |
  target.com    Subdomains            SSL/TLS Certs            Open Ports          Service Versions         S3/GCS/Azure        Unified
               A/AAAA/MX/NS        CT Log Mining              TCP/UDP              Banner Grab             Blob Detection       Registry

Asset Categories

Continuous Monitoring

Asset discovery is not a one-time scan but a continuous process. The platform maintains a living inventory that detects changes in real time:

NIS2 and ZKB Compliance

NIS2 Directive (EU 2022/2555)

The Network and Information Security Directive 2 is the European Union's comprehensive cybersecurity regulation. The EASM module maps discovered assets and findings to NIS2 requirements:

ZKB 264/2025 Sb. (Czech Republic)

The Czech cybersecurity decree (Zakon o kyberneticke bezpecnosti) imposes specific requirements on operators of essential services. The EASM module assesses compliance with:

Compliance Dashboard

# Assess compliance against both frameworks
{:ok, assessment} = PrismaticPerimeter.assess_compliance("target.com", [:nis2, :zkb])
# => %{
#   nis2: %{
#     overall: :partially_compliant,
#     score: 72,
#     articles_assessed: 10,
#     articles_compliant: 7,
#     gaps: [
#       %{article: "21(2)(d)", finding: "No supply chain monitoring detected"},
#       %{article: "21(2)(j)", finding: "MFA not enforced on admin panels"}
#     ]
#   },
#   zkb: %{
#     overall: :compliant,
#     score: 85,
#     requirements_assessed: 8,
#     requirements_met: 8
#   }
# }

Competitive Positioning

The Prismatic EASM module occupies the same market segment as established commercial platforms but differentiates through its architectural integration with the broader intelligence stack:

The key differentiator is epistemic rigor: every EASM finding passes through the same NABLA axiom verification and Trinity Gate validation that governs all platform intelligence products. Ratings are not opaque numbers but fully traceable evidence chains that analysts can inspect, challenge, and verify.

Architecture

LiveView Dashboard

The EASM dashboard is built with Phoenix LiveView, providing real-time updates as discovery scans complete and findings are scored:

/perimeter           -- Main dashboard with overview metrics and rating summary
/perimeter/assets    -- Full asset inventory with filtering and search
/perimeter/compliance -- NIS2/ZKB compliance assessment detail
/perimeter/easm      -- Advanced EASM dashboard with scan management

OTP Process Architecture

PrismaticPerimeter.Supervisor
  |-- DiscoveryWorker (GenServer pool -- parallel asset enumeration)
  |-- ScoringEngine (GenServer -- rating computation and caching)
  |-- ComplianceAssessor (GenServer -- regulatory framework mapping)
  |-- AssetRegistry (ETS-backed -- real-time asset inventory)
  |-- AlertManager (GenServer -- threshold monitoring and notification)

Each component runs as an independent OTP process with supervision, ensuring that a failure in one assessment domain does not cascade to others.

Integration

• Scores feed into Intelligence Synthesis for holistic entity risk assessment
• Monitored through Real-Time Monitoring infrastructure
• Verified by Trinity Gate epistemic validation
• Governed by NABLA Axioms for evidence-based scoring
• Quality enforced by NO MERCY zero-tolerance standards
• Agent operations tracked via Telemetry Integration
• Supports Color Teams with external threat surface data
• Automated through AIAD Standard agent orchestration

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator