External Attack Surface Management (EASM) for UK Businesses

EASM is the continuous discovery and monitoring of everything your organisation exposes to the internet — domains, subdomains, IP addresses, services, certificates and email authentication records. It answers the question every attacker asks first: what can I see and reach from outside? Unknown and forgotten assets are a common way in, and EASM makes them visible before someone else finds them.

Vulnerability scanning assesses assets you already know about; a penetration test is a point-in-time exercise against an agreed scope. EASM works the other way around — it discovers what's exposed (including assets you didn't know you had) and monitors continuously between tests. The three are complementary: EASM finds the estate, vulnerability management assesses it, and pen testing proves what's exploitable.

SurfaceLoop is AMVIA's attack surface monitoring capability: asset discovery from your seed domains, continuous monitoring of domains, IPs, certificates and email authentication records, CVE-matched prioritisation, and audit-ready evidence export. It powers the continuous monitoring inside our Cyber Essentials Plus and managed IT services, and the free attack surface scan in our tools section.

No — and that's deliberate. A monitoring feed without engineers attached is a to-do list, so we include SurfaceLoop inside services where AMVIA acts on what it finds: Cyber Essentials Plus (£400+VAT/month) and our managed IT and security plans. If you just want to see what's exposed today, the free attack surface scan gives you a one-off view of your own domain.

No — SurfaceLoop is the visibility layer: discovery, monitoring and reporting, not a managed SOC or incident response service. That's deliberate and honest. Where findings need acting on, AMVIA's wider managed security services — including vulnerability management and penetration testing — pick up from what SurfaceLoop surfaces.

Cyber Essentials Plus includes continuous external monitoring as standard, because external drift is what fails renewal audits. It also runs inside our managed IT and managed security engagements where continuous visibility is part of the service design. Ask on any service call whether your plan includes it — the answer is on the table before you sign.