Cap 1
Attack surface topology
Internet-facing entry points, the assets behind them and the vulnerable components each path reaches, drawn from live data.
UI · topology
Business initiative
Attack Surface Management (ASM)
ASM answers what you have exposed and what an attacker can reach. Zafran adds the part an inventory cannot: whether each exposure is exploitable right now, and which control you already own covers it.
UI · Attack surface map
Definition
What ASM means
Attack Surface Management (ASM) is the continuous discovery, inventory and monitoring of the assets an organization exposes to attackers, including internet-facing services, cloud resources and the shadow or unknown assets nobody registered. Effective ASM does not stop at a list; it validates which exposures are reachable and exploitable so the team can act on them.
What buyers expect from an ASM program
- Continuous discovery of internet-exposed and unknown assets, outside-in and inside-out
- Exposure validation: is the service reachable, is the vulnerable component running, is it being exploited
- A path from discovery to action: owners, mitigations and remediation, not a standalone dashboard
Mapping
How Zafran maps to your ASM program
Take the requirements column from your RFP; the other two columns are what Zafran delivers and where it sits in the lifecycle.
| Program requirement | Zafran capability | Lifecycle stage |
|---|---|---|
| Continuously discover exposed and unknown assets | Zafran Detector agentless discovery plus cloud, identity and scanner connectors map assets and components as they appear | 01Continuous Discovery & Detection |
| Identify shadow IT and unmanaged services | Reconciles what the network sees against CMDB and cloud inventories to surface assets with no owner or no scanner coverage | 01Continuous Discovery & Detection |
| Validate exposures, not just list them | Reachability analysis from the internet to the vulnerable component, combined with runtime presence and exploitation intelligence | 02Assess & Validate |
| Tie exposures to security controls | Shows which WAF, firewall, EDR or cloud policy already blocks the path, and where coverage is missing | 03Risk Mitigation |
| Shrink the exposed surface quickly | Mitigation through existing controls while decommissioning or patching is scheduled | 03Risk Mitigation |
Capabilities
ASM capabilities, in the product
Stylized dashboard callouts; each tile becomes a short micro-animation in production.
Cap 2
Exposure over time
Exposed services, unknown assets and validated-exploitable paths as a trend.
UI · kpi
Cap 3
Exposed asset inventory
Every externally reachable asset with owner, scanner coverage and control coverage in one table.
UI · table
Cap 4
Asset to findings graph
Click any exposed asset to see its components, findings and the controls between it and the attacker.
UI · graph
RFP checklist
Evaluating ASM vendors? Start here.
Download
ASM evaluation checklist
Requirement language, scoring criteria and proof-of-value tests you can paste into an RFP.
- How are unknown or unmanaged assets discovered, and how soon after they appear?
- Does the platform validate reachability to the vulnerable component, or only detect an open service?
- Can it show which existing control already protects an exposed asset?
- How does it reconcile discovered assets with the CMDB and cloud inventories?
- Does discovery feed directly into prioritization and remediation, or export to another tool?
Outcomes
What ASM teams see with Zafran
1 in 3
CVEs weaponized on the day of disclosure
<24h
from new exposed asset to validated risk
0
new agents required for discovery
Illustrative figures for the wireframe; replace with validated customer outcomes.
“Zafran is tackling vulnerabilities from a hacker's perspective, adding a true layer of risk mitigation through compensating controls.”
Ricardo Lafosse
CISO, Kraft Heinz
“Zafran lets us evaluate the effectiveness and ROI of our security stack against what is actually exploitable.”
Dave Estlick
CISO, Chipotle
FAQ
Frequently asked questions
What is ASM?
Attack Surface Management is the continuous discovery, inventory and monitoring of the assets an organization exposes to attackers, including internet-facing services and unknown or shadow assets.
ASM vs EASM vs CTEM?
External ASM looks at your surface from the outside in. ASM more broadly includes internal and cloud assets. CTEM is the full lifecycle that puts discovery next to validation, mitigation, remediation and reporting. Zafran delivers ASM as the discovery stage of that lifecycle.
Does Zafran replace my EASM scanner?
Zafran ingests EASM findings and adds the internal context they lack: runtime presence, reachability to the vulnerable component and control coverage. Many customers consolidate on Zafran for the action side.
How does Zafran find assets without agents?
Zafran Detector performs agentless discovery and correlates it with cloud, identity, scanner and CMDB connectors to build a reconciled inventory.
What does exposure validation mean?
Confirming that an exposed service is reachable, that the vulnerable component is actually running and that the vulnerability is exploitable or being exploited, before anyone spends time on it.
Bring Zafran into your ASM evaluation
See how the platform maps to your requirements, on your data, in a 30-minute walkthrough.