Back to knowledge base

External attack surface monitoring: evidence for your auditor

Published on August 23, 2026 · Updated on October 30, 2026

The first external scan of an organisation regularly turns up a list of assets nobody had on their radar any more: a test environment that was never shut down, a subdomain from an old campaign, an admin interface that turns out to be reachable from the internet. External attack surface monitoring, also called External Attack Surface Management (EASM), makes exactly that visible: it repeatedly scans, from the outside, everything an organisation exposes to the internet, looking at it the way an attacker would. This article is about using it as an evidence instrument: how to turn external measurements into reporting that holds up in front of an auditor, board member or customer.

How it relates to a vulnerability scan and a pentest

The terms overlap, and that causes confusion. A vulnerability scan checks known systems for known vulnerabilities. A pentest has a specialist deliberately break in within a defined scope, as a snapshot. Monitoring the external attack surface adds two things: it also discovers the assets you had not listed yourself, and it repeats the measurement at a fixed cadence, so that a series of measurements builds up that shows development over time. For the broader explanation of EASM in the context of SMEs and supplier chains, see the article EASM for SMEs and the supply chain; this piece focuses on the evidence side.

When is external monitoring needed?

Internal scans look from inside the network and therefore miss what an outsider sees: forgotten subdomains, expired certificates, services that are public by accident. External monitoring becomes a precondition as soon as one of these situations applies:

• the organisation runs on cloud services and SaaS, so the attack surface lies outside its own network;
• there is a chain of suppliers with access to systems or data, for which you are accountable under the supply-chain duty of care;
• the organisation falls under the Dutch Cybersecurity Act (Cyberbeveiligingswet) or has to show customers that the basics are in order.

Periodic manual tests remain valuable alongside this, for what automated scans miss, such as flaws in business logic.

What an external scan finds

The findings are concrete and verifiable from the outside: open ports and services that should not be public, misconfigurations such as an incorrectly configured certificate or missing security headers, unpatched software with a known CVE number, and shadow IT set up outside the view of the IT department. How such forgotten assets come about and what that means for your compliance is covered in the article on shadow IT and the external attack surface.

How to set it up

You do not build a monitoring programme around a tool, but around a process. Five steps:

1. Baseline and scope. Record which domains, subdomains and IP ranges belong to the organisation and document that scope with a traceable technical record.
2. Fixed cadence. Choose a repeat frequency that fits the risk profile and demonstrably keep to it; the series of reports is the evidence.
3. Risk scoring. A critical CVE on a publicly reachable service calls for a response within days; an expired certificate on a marketing site can wait for the next sprint.
4. Ownership and follow-up. Assign an owner to each finding and schedule the follow-up in your own workflow, so nothing is left sitting in a stand-alone report.
5. Reporting to the board and the auditor. Translate findings into an overview a board member understands quickly, with the underlying evidence available for anyone who asks further.

What makes a report audit-proof?

This is where the difference between paper and measurement comes together. A policy document says the systems are patched; an external measurement shows whether that is also true on the outside. Three characteristics determine whether monitoring reports can carry that difference:

• Traceability. Every finding leads back to a technically observable detail: an IP address, domain, HTTP response or CVE number.
• Sealing with a timestamp. A report that demonstrably has not changed since the scan date prevents discussion about the validity of the evidence.
• External reproducibility. A third party can repeat the observation from the outside themselves.

Article 21 of the NIS2 directive requires appropriate measures and demonstrable risk management and leaves the form of evidence open. This bar comes from audit practice, where traceable and reproducible evidence makes the conversation with an auditor considerably easier than a summary score. Open-source transparency helps here: because the scanning logic of OpenKAT can be publicly checked, an auditor can retrace why a finding was marked as critical. How that sealing works in practice (a PAdES signature with an independent RFC 3161 timestamp) is explained in verifying an Exposentry report.

The same bar for suppliers

Under the Dutch Cybersecurity Act, organisations are also accountable for their suppliers. External measurements give a customer more to go on than a self-completed questionnaire, because the supplier does not draw them up itself: the same scan that monitors your own attack surface can show for suppliers whether their external basic security is in order. That is how monitoring grows from an internal IT tool into an instrument for supply-chain management.

What does it cost?

Expect two kinds of investment. The service itself: a one-off Baseline scan is available from €495, continuous monitoring from €249 per month (see the pricing page for the options). And internal time: after the first clean-up round, allow a few hours per month for assessing and assigning findings. That investment produces a series of audit-proof reports; a one-off test at a day rate answers a different question and gives a single snapshot.

Where Exposentry fits

Exposentry provides external attack surface monitoring for organisations that need evidence: continuous scanning from the first measurement, with a monthly report that is cryptographically signed with an independent timestamp. The scans run on OpenKAT, the open-source scanner developed within the Dutch government; Exposentry is built on it and founder Edward Hasekamp contributes to OpenKAT. Exposentry does not carry out remediation work itself, so the report serves no commercial follow-up interest and remains credible towards the board, customers and auditors. A free security scan shows what an outsider can see of your domain today.

Sources

• EUR-Lex: Directive (EU) 2022/2555 (NIS2), Article 21
• NCSC: De Cyberbeveiligingswet en toeleveranciers (in Dutch)

Further reading

• EASM for SMEs and the supply chain
• Forensically substantiated evidence: what auditors and insurers really want to see
• What does an attacker see of your domain?
• Is a vulnerability scan mandatory under NIS2?

Written by Edward Hasekamp, founder of Exposentry and collaborator on the open-source OpenKAT project. See the project on GitHub and the profile at github.com/hasecon. Exposentry provides EU-sovereign, forensically substantiated vulnerability monitoring based on OpenKAT. More articles in the Knowledge base.