Exposure Management vs Attack Surface Management for Crypto

By the Guardian team Updated November 2026 5 min read

Quick answer. Attack surface management finds what you expose: domains, hosts, cloud services and APIs. Exposure management, often run as Gartner's continuous threat exposure management (CTEM) program, uses that inventory to rank, validate and fix what is actually exploitable.

Watch: Exposure Management vs Attack Surface Management for Crypto 1:47

Video transcript

On April 14, 2026, attackers controlled CoW Swap's domain for about four and a half hours. The entry point was a domain, not a contract.

After a social engineering attack on its registrar, CoW's core team estimates about 1.2 million USDC of user funds was taken.

Attack surface management finds what you expose: domains, hosts, cloud services and APIs. Exposure management ranks, validates and fixes what is actually exploitable.

Exposure management often runs as Gartner's continuous threat exposure management cycle: scoping, discovery, prioritization, validation and mobilization. Attack surface management feeds discovery.

Severity is not exploitation. CISA's Known Exploited Vulnerabilities catalog held 1,768 entries in November 2026, some in tools many crypto teams use.

A typical inventory sees domains, frontends, cloud and APIs, but not registrar access or the bundle a frontend serves. Keys, signers and contract roles sit outside it.

More than 1.5 billion dollars was moved in Bybit's February 2025 hack. Sygnia concluded the malicious code was served from Safe Wallet's AWS bucket, a vendor's asset outside Bybit's inventory.

Guardian's Shield runs reconnaissance and pentesting around the clock on everything facing the internet, and Risk Monitoring watches exposure and contract configuration. Managed Security adds a live threat model, matching disclosures against what you run.

Read the full article to design your program, or talk to Guardian about what attackers can reach.

On April 14, 2026, attackers controlled cow.fi for about 4.5 hours after CoW Swap's domain registrar was exploited in a social engineering attack.

CoW's core team estimates about 1.2M USDC worth of user funds was taken. The entry point was a domain, not a contract.

Two tool categories promise to find gaps like that first: attack surface management (ASM) and exposure management.

Vendors often blur them. This guide separates them for digital asset teams.

Definitions and Where CTEM Fits

Attack surface management

External attack surface management (EASM) maps what you expose to the internet.

Microsoft's Defender EASM, for example, "continuously discovers and maps your digital attack surface to give you an external view of your online infrastructure."

It starts from known assets, called discovery seeds, and follows observed connections to find ones nobody listed. It discovers domains, IP blocks, hosts, email contacts, ASNs and Whois organizations.

Continuous threat exposure management

Gartner introduced CTEM in 2022, according to Tenable. Tenable quotes Gartner's aim: letting an organization "continually and consistently evaluate the accessibility, exposure and exploitability of its digital and physical assets."

IBM and Tenable both describe five stages:

Stage	What happens	The question
Scoping	Pick the attack surfaces to assess, and how often	What matters to us?
Discovery	Find assets and their exposures	What do we have?
Prioritization	Rank by exploitability and asset criticality	What matters most?
Validation	Test attack paths, for example with a pentest	Would it work?
Mobilization	Get fixes through existing workflows	Who fixes it, by when?

ASM sits inside the cycle. IBM lists it among the tools of the discovery stage. Palo Alto Networks calls EASM one layer of a wider exposure management program.

Discovery vs Prioritization

The practical difference is the output.

	Attack surface management	Exposure management
Question	What do we expose?	What could actually hurt us?
Scope	Internet-facing assets	External, cloud, identity, code and more
Ranking	Severity and hygiene	Exploitability and business impact
Testing	Not a defined stage	Validation is a stage
Output	An asset inventory	A ranked, owned fix list

Severity is not exploitation. CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities known to be exploited. Its November 4, 2026 version held 1,768 entries.

Two entries sit in tools many crypto teams use:

CVE-2025-55182: remote code execution in React Server Components, added December 5, 2025.
CVE-2025-30066: malicious code in the tj-actions/changed-files GitHub Action, added March 18, 2025.

Discovery tells you a frontend exists. Prioritization asks whether it runs an affected version, and what a foothold there could reach.

Crypto Assets ASM Tools Miss

A typical EASM inventory starts from domains, IP ranges and hosts. A digital asset team has more to watch:

Asset	What discovery sees	What else to check
Domains and DNS	Domains, subdomains, records	Registrar account, transfer lock, who can edit records
Frontends	Hosts and web apps	The served bundle, third-party scripts, the signing page
Cloud	Exposed hosts and storage	Who can push to the bucket or CDN serving the app
APIs	Endpoints that answer	What each key can do; which calls move funds
Keys and signers	Not in the inventory	Who holds each key, and what it can move
Contracts and roles	Not in the inventory	Admin roles, timelocks, upgrades, configuration drift

Bybit's February 2025 hack shows how these chain. Safe said attackers first compromised a Safe{Wallet} developer machine, leading to a disguised malicious transaction.

Sygnia concluded the malicious code was served from Safe{Wallet}'s AWS S3 bucket. Bybit's post-mortem says ETH and stETH worth more than $1.5 billion was moved.

The frontend and the bucket belonged to a vendor. An inventory of Bybit's own domains would not include them, or show what its signers would approve.

For the full offchain surface, see what offchain security covers. For contracts and roles, see what onchain monitoring watches.

Designing the Program

Map the five stages onto both surfaces:

Scope: every domain, frontend, cloud account and API, plus every contract, role, key and signer.
Discover: start from your names, not a supplied list. Include lookalike domains and new certificates.
Prioritize: rank by what a foothold could sign, deploy or move. Check KEV and advisories against what you run.
Validate: pentest the paths that reach funds, and rehearse pauses on a fork.
Mobilize: name an owner for every asset, agree fix windows, and retest from the outside.

Run it on a cadence and on every change: a new domain, deployment, signer or vendor. For registrars, see the most secure domain registrars.

Buying a Tool vs a Managed Program

A tool gives you discovery, dashboards and connectors. Microsoft's exposure management product, for instance, pulls in data from tools such as ServiceNow CMDB, Tenable, Qualys and Rapid7.

Your team still triages, validates and drives every fix. That suits teams with security engineers on staff.

A managed program adds the people: a provider validates findings, ranks them and works the fixes with you.

Either way, ask:

Does discovery start from our names, or from an inventory we supply?
Does it cover contracts, roles and signers, or only hosts?
Is every finding confirmed by a person before it reaches us?
Is a finding ranked by its score, or by what it can reach?
Who retests after a fix, and from where?

How Guardian Covers Both

Shield is Guardian's continuous coverage of everything you have facing the internet: hosts, ports, services, storage, certificates, edge rules and the names that lead users to you.

It runs reconnaissance and penetration testing around the clock, with no special access needed from you. A Guardian researcher verifies what it finds.

Risk Monitoring watches both surfaces: external exposure, and contract configuration such as privileged roles, timelocks and deployments.

Every finding is confirmed by an engineer, ranked by what reaching it would do, and closed only when the fix is verified from the outside.

Managed Security adds a live threat model of every path to your funds. It matches disclosures against what you run, and an engineer works the patch with you.

Frequently Asked Questions

What is the difference between exposure management and attack surface management?

Attack surface management discovers and inventories what you expose. Exposure management is the wider program that ranks those exposures by exploitability and impact, validates them and drives the fixes. Attack surface management feeds its discovery stage.

What is CTEM?

Continuous threat exposure management, a program Gartner introduced in 2022, according to Tenable. Its five stages are scoping, discovery, prioritization, validation and mobilization, run as a continuous cycle.

Do crypto companies need attack surface management?

Yes, but not alone. It covers the internet-facing part: domains, frontends, cloud and APIs. Keys, signers, contract roles and upgrades sit outside a typical inventory, so pair it with onchain monitoring and signer controls.

Can you buy CTEM as a product?

Not as one tool. Microsoft, for example, says its exposure management product aligns with Gartner's CTEM approach. Scoping and mobilization still need your people or a managed provider.

Sources

Find what attackers can reach, onchain and off

Guardian maps what you expose and how your contracts are configured, confirms every finding by hand, and works the fixes with your team.

Talk to Guardian Explore Managed Security