External footprint
Domains and subdomains, DNS posture, exposed services and publicly visible hosts, including ones missing from internal asset lists.
External attack surface · CISOs · Security architects
QEASM
See what is exposed. Understand the cryptographic signals. Prioritise what matters.
Attackers begin with what they can discover from the internet. Quantum External Attack Surface Management (QEASM) gives security leaders a bounded, evidence-based view of public-facing assets, exposed services and observable cryptographic weaknesses, without committing to an enterprise-wide discovery programme.
How it works
From one approved domain to a prioritised plan.
An initial QEASM assessment starts with a single domain you approve and looks at it the way an attacker would: from the outside, using what the internet already reveals.
- 01 · Scope
Approved domain
One primary domain and its public subdomains.
- 02 · Discover
Internet view
Public services, DNS, TLS and certificates.
- 03 · Assess
Risk signals
Exposure evidence, likely impact and severity.
- 04 · Act
Action plan
Gaps, priorities and recommended next steps.
Larger organisations often run significant public IP space outside their primary domain. With your approval, an assessment can extend to named ASNs and IP ranges to reveal that footprint.
The report
A report that points to the next move.
Not just a list of exposed assets: a concise risk narrative showing what was observed, why it matters, where ownership or evidence is missing, and which actions should come first.
- External exposure inventory: attributed public assets, subdomains, services, DNS and observed certificate and TLS details.
- Severity-ranked findings, each with its evidence, confidence and potential business impact.
- Gap analysis across visibility, security hygiene and observable cryptographic posture, with practical remediation priorities.
- A follow-on discovery plan: candidate high-priority systems and a defined path to CBOM, SBOM, HBOM and migration planning.
example.com
Point-in-time external review
Hostnames68
Resolving41
Certificates26
Findings12
Top findings
| Finding | Hosts | Severity |
|---|---|---|
| Origin server reachable around the CDN | 2 | High |
| Subdomain points at an unclaimed resource | 1 | High |
| Certificate expires within 14 days | 3 | Medium |
| TLS 1.0 and 1.1 still accepted | 4 | Medium |
| No post-quantum key exchange offered | 15 | PQC |
| No MTA-STS policy for inbound mail | 1 | Low |
Sample data for illustration. Evidence-led scoring, observable facts only, no exploitation.
Coverage
What an assessment looks at.
Transport-layer security
Certificate expiry and configuration, TLS versions and cipher exposure, certificate chains, and whether endpoints offer post-quantum key exchange.
Risk context
Misconfigurations, potential vulnerabilities that need validating, and their severity and likely business impact.
Operational readiness
Attribution and ownership gaps, evidence quality, and the systems that warrant deeper CBOM and SBOM investigation.
Method
Non-intrusive by design.
Discovery starts from public records, so most of the picture comes together without sending any traffic to your infrastructure. Direct TLS checks happen only with your authorisation.
Passive discovery
No traffic to your infrastructure.
Authorised TLS checks
Per-host cryptographic detail.
Frameworks
Mapped to recognised security frameworks.
Findings are framed against the standards your auditors and board already use, so they slot into existing risk discussions.
Know what it is. QEASM is an external snapshot, not a complete enterprise cryptographic inventory or a substitute for CBOM and SBOM collection. Standards are reference points for risk discussion: an assessment is not an ISO certification, SOC 2 audit, full control assessment or compliance attestation.
- NIST CSF 2.0
- Govern, Identify, Protect and Detect: asset awareness, risk prioritisation, protective configurations and visibility gaps.
- ISO/IEC 27001:2022
- Risk-based ISMS context: relevant controls for inventory, technical vulnerabilities, configuration and cryptography.
- SOC 2
- Security-focused evidence against the Trust Services Criteria, as input to access, monitoring, risk and change-control discussions.
- NIST PQC · CCCS
- PQC identification and transition (FIPS 203, 204 and 205; ITSM.40.001): flags areas for deeper cryptographic discovery, with Government of Canada relevance where it applies.
Beyond the perimeter
From external exposure to critical BOMs.
An external scan shows where risk may exist, but it can’t reliably identify every library, encryption implementation or hardware dependency behind a service. QSE uses the initial findings to guide a separately scoped discovery phase that builds a defensible cryptographic baseline and a prioritised backlog: what to rotate, refactor, re-platform or retire.
Cryptographic components
Protocols, algorithms, cipher suites, key lengths and certificates.
Software components
Libraries, packages, versions and third-party dependencies.
Hardware components
Devices, firmware, modules and network appliances.
Optional next step
30-day Cryptographic Feasibility Assessment
For one approved high-priority system, a customer-hosted, passive telemetry engagement validates deeper discovery before any enterprise-wide rollout. For Government of Canada clients, it helps advance CCCS ITSM.40.001 Identification.
- Days 01–05
Connect
VM set-up and a SPAN or vTAP connection.
- Days 06–25
Observe
Passive traffic telemetry.
- Days 26–30
Report
CBOM artefacts, a risk scorecard and a briefing.
Example boundary: one high-priority system, one network security zone or VLAN, one SPAN/vTAP feed and up to 20 endpoints. Outputs can include a machine-readable CBOM (JSON or CSV), a cryptographic debt scorecard and a procurement-ready scope for broader discovery. Subject to security review and agreed deployment conditions.
Why start here
Three practical reasons to start with QEASM.
- Reduce blind spots. Find attributable subdomains, internet-facing infrastructure and public services that may not appear in internal asset lists.
- See crypto risk earlier. Observe TLS configurations, certificate health and exposed cryptographic dependencies that warrant deeper review.
- Focus investment. Separate urgent exposures from longer-term improvements, and get a practical starting point for PQC readiness.
Specifications
At a glance.
- Scope
- One approved primary domain and its public subdomains · approved ASNs or IP ranges optional
- Method
- Point-in-time · external · non-intrusive · no exploitation
- Evidence
- DNS records · TLS handshakes · Certificates · Public services
- Outputs
- Exposure inventory · Ranked findings · Gap analysis · Follow-on discovery plan
- Not included
- Penetration testing, exploitation, intrusive validation, internal scans, ongoing monitoring, remediation, extra domains and full BOM production, unless separately authorised
Get started
Start small. Scale with confidence.
Start with one approved domain, establish the evidence, then scale discovery with confidence. Talk to the team about scoping an initial QEASM assessment.