The terms security leaders, auditors, and boards use when they talk about what's exposed — defined without the jargon. Jump to a term:
The full set of points where an attacker could try to get into — or pull data out of — your systems. The external attack surface is everything reachable from the public internet: domains, subdomains, APIs, cloud storage, exposed services, and leaked credentials.
The continuous practice of discovering, inventorying, and monitoring the assets that make up your attack surface — so you find exposures before an attacker does, not in a once-a-year review.
Public logs of every TLS certificate issued. Security teams (and attackers) mine them to discover subdomains and hosts an organization owns — including ones it has forgotten.
When usernames and passwords leak through breaches and end up on the dark web. "Credential stuffing" is replaying those logins against your systems — reused employee credentials are a common path straight to admin portals.
A public catalog of known security vulnerabilities, each with a unique identifier (e.g. CVE-2024-12345), so everyone can refer to the same flaw unambiguously.
A 0–10 score expressing how severe a vulnerability is, factoring in how easy it is to exploit and how much damage it can do.
Watching underground forums, breach dumps, and criminal markets for mentions of your organization, employees, credentials, or data — so you hear about a leak early, not after it's weaponized.
An EU regulation requiring financial entities to manage their ICT and third-party risk — including a clear handle on their digital attack surface.
ASM focused specifically on internet-facing assets, discovered from the outside in — the way an attacker actually sees you, rather than from an internal asset list. TRaViS is an EASM platform.
Internet-reachable LLM endpoints, model APIs, and MCP servers — a fast-growing attack surface that almost nobody is watching, and one TRaViS surfaces by default.
An open protocol that lets AI assistants connect to external tools and data. Exposed or unauthenticated MCP servers can leak data or be abused — which is why they belong on your attack surface inventory.
A security weakness caused by incorrect settings rather than a software bug — like a public cloud storage bucket, an open database, or an overly permissive service.
The New York Department of Financial Services Cybersecurity Regulation (23 NYCRR 500), which requires covered financial firms to run a documented cybersecurity program.
A penetration test is a deep, point-in-time assessment of specific systems. ASM is broad, continuous discovery and monitoring of everything you expose. They complement each other — ASM tells you what to point a pen test at.
A single, rolled-up measure of how exposed an organization is — TRaViS uses a 0–1000 score, benchmarked against your sector. It's the quick, board-ready answer to "are we exposed?"
A cloud object-storage container (such as an Amazon S3 bucket) misconfigured to allow public access — a frequent source of leaked customer data.
The attacker's first move: quietly mapping a target's assets and weaknesses before striking. EASM runs the same reconnaissance — on your behalf, continuously.
An undocumented, deprecated, or forgotten API endpoint that's still answering requests — outside the security team's visibility, and a favorite attacker entry point.
Systems, apps, or cloud assets stood up or used without the security/IT team's knowledge or approval — you can't protect what you don't know you own.
A vulnerability that tricks a server into making requests on an attacker's behalf — often used to reach internal-only systems or steal cloud metadata credentials. An exposed internal machine plus an SSRF is a classic breach chain.
When a subdomain's DNS still points to a cloud service that's no longer claimed, letting an attacker register that service and take control of the subdomain — to phish, serve malware, or steal cookies.
A vulnerability unknown to the vendor — and therefore unpatched — at the time it's discovered or exploited. The window before a fix exists is the most dangerous.