How is CAASM different from a CMDB?

A configuration management database is usually filled by manual entry and periodic imports, so it drifts between updates. CAASM populates and reconciles records continuously from discovery scans, directories and cloud APIs, removes duplicates, and adds security context such as which accounts can log in to each asset. Many teams feed CAASM results back into the CMDB.

What is the difference between CAASM and EASM?

External attack surface management looks at an organisation from the internet, finding exposed domains, services and certificates. CAASM looks inward, building a complete inventory of internal and cloud assets and identities from internal discovery and integrations. The two answer different questions and are often used together.

Glossary

Cyber asset attack surface management (CAASM)

Also called CAASM, cyber asset management, asset attack surface management

Cyber asset attack surface management (CAASM) is the practice of continuously discovering an organisation's devices, workloads and identities, reconciling them into one accurate inventory, and showing how they connect, so that unmanaged assets, excess access and attack paths can be found and fixed.

Rudratic glossary

You cannot protect an asset you do not know about, or limit access you cannot see. CAASM brings together what discovery scans, directories, cloud APIs and existing tools know about each device and account, removes duplicates and conflicts, and presents one record per asset. Mapping identities onto those assets then shows who can reach what and how an attacker could move from one machine to the next.

How it works

Discover assets continuously over network protocols, directory services and cloud APIs, ideally without agents so unmanaged devices are found too.
Reconcile records from different sources into one entry per asset, using stable identifiers rather than addresses that change.
Enrich each asset with its operating system, owner, environment, security tool coverage and the identities that can log in to it.
Analyse relationships as a graph to find privilege escalation chains and paths to critical systems such as domain controllers.
Act by exporting gaps and risky paths to the teams and tools that fix them.

Why it matters

Asset inventory is a baseline control in every major framework. CIS Control 1 calls for actively managing all enterprise assets, including end-user devices, network equipment, IoT devices, servers and cloud assets, so that unauthorised and unmanaged assets can be found. NIST SP 800-53 Rev. 5 control CM-8 requires an inventory of system components that accurately reflects the system, with no duplicate accounting. CISA’s Binding Operational Directive 23-01, issued in October 2022, requires US federal agencies to perform automated asset discovery every 7 days. Zero trust depends on it too: NIST SP 800-207 asks enterprises to monitor the integrity and security posture of all owned and associated assets.

CAASM vs neighbouring tools

Tool	Main question
CMDB	What do we believe we own and how is it configured?
CAASM	What actually exists, who can reach it, and through which paths?
Vulnerability scanner	Which known weaknesses does each asset have?
EASM	What can the internet see of us?

Examples

A host appears on the network between CMDB imports and is found within the next discovery cycle.
A server marked active in the CMDB has not answered for months and is retired.
A nested AD group chain gives a helpdesk account a path to local admin on a domain controller.

How SWOT supports it

SWOT Radar is cyber asset attack surface management. It discovers devices without agents across CIDR ranges, Active Directory, AWS, Azure, GCP and VMware, matches records on MAC address before IP so a host keeps its identity through address changes, and stores the local admins, sudo and wheel members and SSH users for every host. It follows nested AD groups down to five levels and finds the shortest paths to a domain controller. Related: identity security and least privilege.

Questions

How is CAASM different from a CMDB?: A configuration management database is usually filled by manual entry and periodic imports, so it drifts between updates. CAASM populates and reconciles records continuously from discovery scans, directories and cloud APIs, removes duplicates, and adds security context such as which accounts can log in to each asset. Many teams feed CAASM results back into the CMDB.
What is the difference between CAASM and EASM?: External attack surface management looks at an organisation from the internet, finding exposed domains, services and certificates. CAASM looks inward, building a complete inventory of internal and cloud assets and identities from internal discovery and integrations. The two answer different questions and are often used together.

In SWOT

SWOT Radar