Question 1

What is ComplAI ASM?

Accepted Answer

ComplAI ASM is the attack surface management domain inside ComplAI. Security teams get continuous outside-in discovery across 20 capability modules, light scans in minutes, deep scan campaigns for subdomain and port discovery, 800+ exposure rules, CVE and EPSS prioritization, shadow IT and cloud ASM, issues with SLA tracking, bulk remediation, and a 0–950 posture score on the leadership dashboard — linked to your GRC program.

Question 2

What ASM capability modules are included?

Accepted Answer

ASM includes eight core modules — Discovery, Shadow IT, Prioritization, Monitoring, Expander, Attribution, Cloud ASM, and Response — plus twelve solution workspaces: Attack Paths, Threat Exposure, Secret Exposure, Credential Intel, Web/API Scan, DNS Takeover, Posture Trends, Compliance Risk, Due Diligence, Cyber Insurance, Portfolio Risk, and Vendor Exposure.

Question 3

How does outside-in asset discovery work?

Accepted Answer

ASM discovers internet-facing domains, subdomains, IPs, services, certificates, and cloud assets without deploying agents on every host. Passive and active techniques, seed-domain expansion, and enrichment from sources such as Shodan, Censys, and BitSight keep inventory current as your surface changes.

Question 4

How are ASM findings prioritized?

Accepted Answer

Exposures are ranked using CVE and EPSS exploit probability, CVSS severity, asset criticality, and business context — so teams focus on internet-reachable paths attackers would exploit first, not just the noisiest scanner output.

Question 5

Does ASM appear on the leadership dashboard?

Accepted Answer

Yes. ASM posture score, open exposures, critical findings, and asset counts feed the ComplAI leadership dashboard alongside framework readiness and vendor risk — giving CISOs and CIOs one executive view of outside-in exposure.

Question 6

How does ASM connect to ComplAI GRC and TPRM?

Accepted Answer

ASM runs inside ComplAI and links remediation cases to your control and risk program. Vendor attack-surface vectors also correlate with ComplAI TPRM ratings, so third-party risk and your own internet footprint stay connected for security operations and audit narratives.

Question 7

What is the difference between light scan and deep scan?

Accepted Answer

Light scan refreshes outside-in intelligence in about one to two minutes using seed domains and enrichment providers. Deep scan runs a multi-phase campaign — subdomain enumeration, host resolution, port scanning, and finding merge — for thorough discovery when you need expanded inventory beyond the daily light refresh.

ASM

Overview

Who it's for

Key capabilities

Other solutions