Attack Surface Manager (ASM) for agentless asset discovery and inventory
Attack Surface Manager (ASM) is the DigitalXForce module that discovers and inventories IT and OT assets through APIs, with no agents to install. It finds every device, application, cloud resource and service an organization runs, including the ones nobody registered, and keeps the list current. It works with the scanners and the CMDB already in place. Attack Surface Manager is one of the 15 modules of the TRiSCM™ (Trust, Risk, Security and Compliance Management) platform.
Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. It cannot test an asset that is missing from the inventory. Attack Surface Manager supplies the list it starts from.
What does Attack Surface Manager do?
Attack Surface Manager discovers every device, application and endpoint an organization runs, and continuous scanning keeps that asset list updated. Its exposure map shows vulnerabilities both inside and outside the network.
Shadow IT detection spots unauthorized devices and services, so the security team can decide what to do with each one. For every asset the organization owns or uses, attack surface insights add the risk context. The Attack Surface Management and Asset Inventory solution page lists the same five capabilities.
How does Attack Surface Manager find assets nobody registered?
DigitalXForce builds the inventory from what Attack Surface Manager reads, instead of starting from a list someone typed in. Attack Surface Manager reads the systems it monitors through their APIs, and the credentials stay under the customer’s control. For assets inside the network, it also runs an on-site network sweep.
A device that was never registered lands in the same list as the assets the organization approved, and shadow IT detection flags it there.
Why does the asset inventory come before control testing?
An asset missing from the inventory has no control test covering it. Continuous Control Assurance only tests the assets its sources report. An assurance gap is the time, or the set of controls, for which an organization has no current evidence that a control still operates as expected.
An unlisted server or cloud account sits inside that gap until Attack Surface Manager adds it. From then on, its controls are tested like those of every other asset.
How does Attack Surface Manager work with existing scanners and the CMDB?
Attack Surface Manager uses the scanners and the CMDB a security team already has, and it does not replace them. DigitalXForce connects to those tools through 250+ technology integrations. The platform is built on a Cybersecurity Mesh Architecture, so each tool stays where it is and feeds one shared view.
How does Attack Surface Manager connect to the rest of DigitalXForce?
Attack Surface Manager shares one data layer with the other 14 DigitalXForce modules. X-SPM is Extended Security Posture Management, the DigitalXForce capability that scores security posture across the enterprise and its vendors from the same control data, and it adds outside signals such as attack surface scans.
The Enterprise Security Risk and Posture Management (ESRPM) module lists attack surface management among its capabilities. Attack Surface Manager finds the assets, and ESRPM checks how each security tool is configured.
X-ROC, the XForce Risk Operations Center, is the operations layer of the DigitalXForce TRiSCM platform, where control failures, risk changes and vendor events are alerted, triaged, escalated and reported. A failed control on an inventoried asset reaches X-ROC as an alert, with the evidence attached.
Attack Surface Manager covers the assets an organization runs itself. Suppliers are covered by External Risk View (ERV), which watches exposed services, breach intelligence, lookalike domains and fourth parties from outside, with no agent and no cooperation from the supplier. Those signals go into each supplier’s own score in the AI-Powered Third-Party Risk Management (TPRM) module.
Questions to ask any attack surface management vendor
Any attack surface management vendor can answer these questions in a demo, DigitalXForce included. The answers show whether the inventory is discovered or entered by hand.
- Ask whether the inventory is built from what the platform reads or from a spreadsheet somebody keeps.
- Ask whether discovery needs an agent on each device, and who holds the credentials it uses.
- Ask how assets inside the network are found, and whether OT assets appear in the same list as IT assets.
- Ask whether the platform works with your current scanners and CMDB or expects to replace them.
- Ask what the team sees next to a device that turns up unannounced.
- Ask how a newly found asset reaches control testing, so it does not stay in an assurance gap.
How can a team see Attack Surface Manager on its own systems?
The standard DigitalXForce proof of value runs for 4 weeks on the customer’s own systems and frameworks. Connectors are configured in week 1, and the attack surface and External Risk View are set up in week 2. The first assessments run in week 3 and are reviewed with the customer in week 4. The 4-week proof of value page describes each week.
DigitalXForce Lite is the full DigitalXForce platform hosted in the cloud, with the same functionality, for any organization that prefers cloud hosting. It runs the same on-site network sweep.
Questions about Attack Surface Manager
What is Attack Surface Manager (ASM)?
Attack Surface Manager (ASM) is the DigitalXForce module that discovers and inventories IT and OT assets through APIs, with no agents to install. It works with the scanners and the CMDB an organization already runs. Attack Surface Manager is one of the 15 modules of the DigitalXForce TRiSCM platform.
Does Attack Surface Manager need agents on each device?
Attack Surface Manager needs no agents. DigitalXForce reads from the systems it monitors through their APIs, using credentials that stay under the customer’s control. For assets inside the network, Attack Surface Manager also runs an on-site network sweep.
Does Attack Surface Manager replace our scanners or our CMDB?
Attack Surface Manager keeps the scanners and the CMDB an organization already runs. DigitalXForce connects to those tools through 250+ technology integrations, and each tool feeds one shared view.
How does Attack Surface Manager find assets nobody registered?
DigitalXForce builds the inventory from what Attack Surface Manager reads through APIs and the on-site network sweep. A device or service appears in the inventory whether or not anyone registered it, next to the assets the organization approved.
Why does the asset inventory come before control testing?
Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. CCA only tests the assets its sources report. An unlisted server or cloud account stays in an assurance gap until Attack Surface Manager adds it.
How is Attack Surface Manager different from External Risk View?
Attack Surface Manager inventories the assets an organization runs itself. External Risk View (ERV) is the DigitalXForce outside-in engine. It watches exposed services, breach intelligence, lookalike domains and fourth parties. The two modules share one data layer, and the proof of value sets both up in week 2.
Does DigitalXForce Lite include Attack Surface Manager?
DigitalXForce Lite includes Attack Surface Manager and its on-site network sweep. DigitalXForce Lite is the full DigitalXForce platform hosted in the cloud, with the same functionality, for any organization that prefers cloud hosting.
Related pages
The Attack Surface Management and Asset Inventory solution page describes the problem this module solves. Three DigitalXForce articles go further.
- The article 10 Critical Attack Surface Management (ASM) Blind Spots Undermining Your Security Posture walks through ten blind spots, among them shadow IT, incomplete asset inventory and legacy systems.
- In The Big Question: Is Attack Surface Management Limited To The Surface?, DigitalXForce sets out its approach to going beyond the exposed surface.
- The article Building Cyber Resilience with DigitalXForce Integrated ASM Solution covers common external attack surface threats and how attack surface management combines with asset inventory.
The Continuous Control Assurance page explains how a control result is validated. The X-ROC page shows how an alert is triaged and closed. The External Risk View page lists the outside signals DigitalXForce watches for suppliers. The AI-Powered Third-Party Risk Management page covers supplier risk, and the glossary entry for Attack Surface Manager defines the module alongside the rest of the platform.
Sources
- DigitalXForce describes Attack Surface Manager on its Attack Surface Management and Asset Inventory solution page and in its glossary. Both were read on October 25, 2026.
- DigitalXForce describes External Risk View, X-ROC, ESRPM and DigitalXForce Lite on their product pages, read on October 25, 2026.
See it on your own systems.
A 30 minute walkthrough on your own frameworks shows how Attack Surface Manager would build the inventory from your own systems. The DigitalXForce team answers every demo request within 1 business day.
