ASM ACADEMY

ASM academy: from asset discovery to a fixed exposure, lesson by lesson

THE SHORT ANSWER

Ten lessons in four tracks: from list to evidence, proving, fixing and buying. Each takes a few minutes and links to the sources it uses. Start with the six steps from an unlisted asset to a fixed exposure if you are new to attack surface management.

By The Perimeter Desk · EASM Compared · Published 2026-10-11

Track 1: How does a list become evidence?

01
The six steps from an unlisted asset to a fixed exposure
Found, owned, proven, contained, routed, rechecked.
3 min read
02
Reachable, vulnerable, exploitable: three different claims about an exposure
Three claims that ASM reports often blur.
3 min read
03
Why finding more assets is not the goal of attack surface management
What to count instead of assets.
3 min read

Track 2: How do you prove an exposure is real?

04
Safe exploit validation in production: rules of engagement
What to agree before a tool tests live systems.
3 min read
05
What adversarial exposure validation (AEV) adds to attack surface management
AEV, pentests and ASM: where each starts and stops.
3 min read
06
The first day after a new CVE: match, prove, contain
A playbook for the first 24 hours.
3 min read

Track 3: How do you get it fixed?

07
Compensating controls for external exposures: holding the line before the patch
Four ways to buy time, and what each costs.
3 min read
08
Writing an exposure ticket an owner will act on
Seven fields that get a fix scheduled.
3 min read
09
Retesting: how to close an external exposure for real
Why closed is not the same as fixed.
2 min read

Track 4: How do you buy for proof and fixes?

10
Running a discovery-to-fix proof of concept for ASM tools
A scorecard by step, not by asset count.
3 min read