What is an operation of an Attack Surface Management (ASM) platform?

Attack Surface Management (ASM) is the continuous process of discovering, inventorying, classifying, and monitoring all internet-facing assets of an organization. The primary operation of an ASM platform, like Palo Alto Networks Cortex Xpanse, is to provide an "outside-in" view, mimicking an attacker's perspective. It continuously scans the global internet to find and map all connected assets—both known and unknown—to an organization, identifying potential exposures, vulnerabilities, and security gaps that could serve as attack vectors.

A. This describes a function of a Cloud Access Security Broker (CASB) or Cloud Security Posture Management (CSPM) tool, which focuses on sanctioned cloud services rather than the entire internet-facing attack surface.

C. This is the definition of a Data Loss Prevention (DLP) solution, which is designed to monitor and protect sensitive data in motion, at rest, and in use, not discover external assets.

D. This specifically describes the function of a SaaS Security Posture Management (SSPM) solution, which focuses on identifying and remediating misconfigurations within known, sanctioned SaaS applications.

1. Palo Alto Networks. (n.d.). What is Attack Surface Management (ASM)? Palo Alto Networks Live Community. Retrieved from https://www.paloaltonetworks.com/cyberpedia/what-is-attack-surface-management.

Reference Point: The article states

"Attack surface management (ASM) is the continuous discovery

analysis

remediation and monitoring of the cybersecurity vulnerabilities and potential attack vectors that make up an organization's attack surface... An ASM platform automatically and continuously discovers an organization’s internet-facing assets..." This directly supports the continuous discovery of all internet-connected assets.

2. Palo Alto Networks. (2023). Cortex Xpanse Datasheet.

Reference Point: Page 1

"Key Capabilities" section. The document states that Cortex Xpanse provides "Continuous Discovery and Monitoring: Continuously discover and monitor all your internet-connected assets and services 24/7

including previously unknown and unmanaged assets." This aligns perfectly with the correct answer.

3. Palo Alto Networks. (n.d.). What is SaaS Security Posture Management (SSPM)? Palo Alto Networks Cyberpedia.

Reference Point: The article defines SSPM as tools that "continuously assess security risks and manage the security posture of SaaS applications." This confirms that option D describes SSPM

not ASM.