Identity-First EASM
Identity-First External Attack Surface Management (EASM) is an advanced cybersecurity strategy that prioritizes discovering and protecting human and non-human identities, the primary gateway to an organization's external digital assets. While traditional EASM focuses on finding "things" like IP addresses and servers, Identity-First EASM focuses on the "who" and "what" that have the permissions to access or manage those things.
In a cloud-centric world, the perimeter is no longer a physical firewall; it is the identity. Identity-First EASM bridges the gap between traditional asset discovery and identity and access management (IAM) by monitoring how external-facing identities—such as leaked credentials, developer profiles, and third-party service accounts—create risk for the organization.
Core Components of Identity-First EASM
To implement an identity-first approach to attack surface management, organizations focus on several key pillars:
Credential Leakage Monitoring: Continuously scanning the dark web, public code repositories (like GitHub), and paste sites for exposed usernames, passwords, and API keys belonging to employees or automated systems.
Non-Human Identity (NHI) Discovery: Identifying the service accounts, bots, and automated "machine" identities that interact with external cloud environments. These often have high-level permissions but lack the same oversight as human accounts.
Social Footprint Mapping: Analyzing the public-facing profiles of "high-value targets"—such as IT admins, developers, and executives—on platforms like LinkedIn or technical forums to identify who has the keys to the kingdom.
Entitlement Visibility: Mapping discovered identities to the specific external assets they can control. This helps security teams understand if a single leaked credential could lead to the takeover of a critical cloud bucket or DNS setting.
Workforce Attack Surface Management: Evaluating the risk posed by the "human element," including employees whose digital habits or exposed personal information make them prime targets for sophisticated social engineering and phishing.
The Strategic Shift: From Assets to Access
The primary difference between traditional EASM and an Identity-First approach lies in the starting point of the investigation.
Traditional EASM asks: "Which of my servers are exposed to the internet?" Identity-First EASM asks: "Which identities have the power to expose my servers to the internet?"
By focusing on identity, organizations can prevent breaches that don't involve a technical "vulnerability" in the traditional sense. For example, a perfectly patched server can still be compromised if an attacker steals the administrative identity that manages the cloud environment where that server lives.
Benefits of an Identity-First Approach
Reduction in Ransomware Risk: Most ransomware attacks begin with identity compromise. By identifying leaked credentials early, organizations can force password resets before an attacker gains initial access.
Shadow IT Prevention: Identity-First EASM can find "Shadow SaaS" by identifying where corporate identities (emails) are being used to sign up for unauthorized third-party services.
Improved Cloud Security: Since cloud resources are managed through identity-based consoles, securing identities is the most effective way to protect the underlying infrastructure.
Contextual Risk Prioritization: It allows security teams to prioritize fixing a "medium" vulnerability on a server if they know that a "high-privilege" identity associated with that server has already been compromised.
Common Questions About Identity-First EASM
How does Identity-First EASM help with phishing?
It identifies which employees are most likely to be targeted based on their publicly available technical profiles and whether their credentials have appeared in prior data breaches. This allows for more targeted security training and stricter authentication controls for at-risk users.
Is this the same as Identity and Access Management (IAM)?
No. IAM manages known identities within your network. Identity-First EASM discovers how your identities are exposed and used outside your network, such as on dark web markets, in public code leaks, or through unauthorized SaaS applications.
Why are Non-Human Identities (NHIs) included?
Non-human identities—like API keys or service tokens—are often hardcoded into software or scripts. If these scripts are accidentally made public on a site like GitHub, an attacker can use that identity to bypass all traditional firewalls and access your data.
Can Identity-First EASM replace traditional EASM?
It is most effective when used as a complementary layer. While you still need to know which servers are open to the internet (traditional EASM), the identity-first layer tells you which accounts are most likely to be used to break into those servers.
How ThreatNG Powers Identity-First External Attack Surface Management
In a borderless digital environment, identity has become the new perimeter. ThreatNG is a specialized engine for Identity-First External Attack Surface Management (EASM), shifting the focus from merely identifying servers to uncovering the human and non-human identities that control them. By providing an "outside-in" view of an organization’s digital footprint, ThreatNG identifies exposed identities and their associated risks before they can be exploited.
Recursive External Discovery of Identity-Centric Assets
ThreatNG uses a purely external, unauthenticated discovery process to map an organization's digital presence without requiring internal agents or prior information. This discovery is recursive, meaning it follows digital clues to find assets that traditional scanners often miss.
Shadow SaaS Identification: ThreatNG uncovers "Shadow SaaS" and unauthorized cloud instances in which employees may use corporate identities to sign up for third-party services outside IT's control.
Recursive Digital Footprinting: Starting with a primary domain, the engine finds related subdomains, cloud storage buckets, and code repositories where identities may be exposed.
Unmanaged Infrastructure Discovery: It identifies forgotten development environments or marketing sites that often lack modern authentication controls, providing an easy entry point for attackers using stolen credentials.
Advanced External Assessment and Security Ratings
ThreatNG performs deep-level assessments to determine an organization's susceptibility to identity-based attacks. These findings are translated into objective security ratings (A to F) that provide a clear benchmark for risk.
BEC and Phishing Susceptibility Assessment
This assessment evaluates how easily an attacker can impersonate corporate identities or launch successful phishing campaigns.
Detailed Example: ThreatNG may identify that a company domain lacks a "reject" policy in its DMARC records while simultaneously discovering several "look-alike" domains registered by third parties. This combination indicates a high risk of Business Email Compromise (BEC), in which an attacker could successfully spoof an executive's identity to authorize fraudulent financial transactions.
Subdomain Takeover Susceptibility
This assessment focuses on "dangling DNS" records where a subdomain points to an external service that is no longer in use.
Detailed Example: ThreatNG identifies a CNAME record for "dev-portal.company.com" pointing to an abandoned GitHub Pages site. It confirms that the site is unclaimed, alerting the organization that an attacker could take over that subdomain and host a fake login page, effectively hijacking the company's trusted identity at that URL.
Proactive Identity Protection Through Investigation Modules
ThreatNG features high-fidelity investigation modules designed to go deep into specific areas where identities are most vulnerable.
Social Media Discovery: This module maps the "Human Attack Surface" by monitoring public platforms like LinkedIn and Reddit for mentions of internal technical details.
Detailed Example: ThreatNG flags a Reddit post from an IT administrator discussing specific software versions and internal server naming conventions. An attacker could use this information to craft a highly personalized spear-phishing email that appears to come from a trusted internal source.
Sensitive Code Exposure: This module scans public code repositories like GitHub and GitLab for accidentally exposed credentials and keys.
Detailed Example: It may discover a public repository containing an API key or a service account token (a Non-Human Identity) that provides administrative access to a cloud database. Finding this before an attacker does allows for immediate key rotation.
Technology Stack Investigation (SaaSqwatch): This module identifies nearly 4,000 unique vendors and technologies in use, allowing security teams to see which identities have access to which third-party platforms.
Strategic Intelligence Repositories: DarCache
ThreatNG maintains the DarCache, a set of continuously updated intelligence repositories that provide real-world context to technical findings.
DarCache Dark Web: A searchable, sanitized mirror of dark web activity. Security teams use this to find if employee credentials or session cookies are currently being traded on underground markets.
DarCache Ransomware: This repository tracks active ransomware groups. It allows organizations to see whether their exposed identities or vulnerabilities align with the preferred entry methods of gangs currently targeting their industry.
DarCache 8-K: This repository benchmarks threats against SEC Form 8-K filings, providing the board with real-time visibility into how their identity-related risks compare to those of their peers.
Continuous Monitoring and Reporting with DarChain
ThreatNG moves away from "point-in-time" audits by providing continuous visibility that aligns with Continuous Threat Exposure Management (CTEM) frameworks.
Legal-Grade Attribution: ThreatNG provides mathematical proof of asset ownership. This allows a CISO to act as a Score Auditor, providing the evidence needed to dispute and correct inaccurate security ratings from third-party agencies that may have misattributed a "ghost asset" to their organization.
DarChain Exploit Mapping: Technical findings are woven into a visual "DarChain" that shows the exact path an attacker would take.
Detailed Example: A DarChain report might show how an exposed employee profile on LinkedIn (Step 1) led to a spear-phishing attack that harvested a credential (Step 2), which was then used to access an unmanaged cloud bucket (Step 3). This helps leadership understand the business impact of a single exposed identity.
Cooperation with Complementary Solutions
ThreatNG serves as a foundational intelligence layer that enhances the performance of other security investments through proactive collaboration.
Complementary Solutions: SIEM and XDR: By feeding confirmed external identity risks and exposed credentials into SIEM or XDR platforms, security teams can prioritize internal alerts. This cooperation ensures that the SOC focuses on internal login events that are directly linked to an identity known to be compromised on the dark web.
Complementary Solutions: Breach and Attack Simulation (BAS): ThreatNG provides BAS tools with "real-world" intelligence, such as leaked credentials and "forgotten side doors." This cooperation allows BAS tools to test whether the organization's defenses can stop an attacker who already has a legitimate, albeit stolen, identity.
Complementary Solutions: Cyber Risk Quantification (CRQ): ThreatNG provides the "telematics"—actual facts about brand impersonation and credential leaks—that CRQ platforms use to calculate financial risk. This cooperation moves risk modeling away from industry averages and toward a personalized financial view of identity-based exposure.
Common Questions About Identity-First EASM and ThreatNG
Why is identity discovery more important than server discovery?
While identifying open ports is important, an attacker with a stolen administrative identity can bypass all traditional firewalls and security controls. Identifying which identities are exposed provides a more direct view of the paths an attacker is most likely to use.
What is a Positive Security Indicator?
Unlike most tools that only report flaws, ThreatNG documents security strengths. It identifies and reports on the active use of Multi-Factor Authentication (MFA), Web Application Firewalls (WAFs), and robust DMARC policies. This helps security leaders prove the effectiveness of their defensive investments.
How does ThreatNG find identities on the dark web?
ThreatNG’s DarCache Dark Web repository is a navigable mirror of dark web forums and marketplaces. It allows you to search for your organization’s specific domains or employee email addresses to identify compromised data without directly interacting with malicious actors.
Can ThreatNG help with regulatory compliance?
Yes. By providing continuous monitoring and mapping findings to the MITRE ATT&CK framework, ThreatNG helps organizations meet the requirements for continuous validation and materiality reporting found in the SEC's cybersecurity disclosure mandates and the DORA framework.
