EASM — Architecture
EASM is the non-intrusive discovery module. It turns a set of seed domains into a map of everything the organization exposes to the internet, then into findings — without sending a single attack payload. It rides the shared platform engine (normalize → enrich → finalize); this page is the EASM-specific pipeline and how it stays non-intrusive. For the shared engine (the scanner contract, normalizer, finalization pass, knowledge base) see Platform Architecture.
The EASM pipeline
A scan runs these scanners in order; each reads the assets the previous stage wrote (the database replaces intermediate files):
Code:
app/engine/runner.py(EASM_PIPELINE),app/scanners/easm/*(the scanners),app/scanners/manifests.py(the Nuclei template profiles).
| Stage | Scanner | What it does |
|---|---|---|
| Discover | subfinder | Enumerate subdomains of the seed domains. |
| Resolve | dnsx | Resolve names → IP addresses. |
| Enrich | enrich_* | Shodan / GreyNoise / AbuseIPDB / OTX / VirusTotal / Censys — ports, CPEs, reputation, ASN per IP. |
| Ports | naabu | Scan sensitive ports — only on hosts the org owns (see Guardrails). |
| Web | httpx | Find live web services on the resolved hosts. |
| Detect | nuclei (detect tier) | Fast, high-signal detection: technologies, misconfiguration, exposures, exposed panels, takeovers, default logins, SSL/DNS/network. |
| CVEs | nuclei (CVE tier) | Known-CVE detection by version/banner inference — never by sending an exploit. |
How EASM finds CVEs without attacking
EASM detects known vulnerabilities the non-intrusive way: it infers the running product + version (httpx/Shodan banners, fingerprints) and correlates that against vulnerability intelligence (NVD / OSV version ranges, endoflife.date for EOL, CISA KEV + EPSS for exploitability) in the shared finalization pass. Payload-based CVE checks (SQLi/RCE/…) are deliberately excluded here and handled by the DAST module.
Output
Everything normalizes into the shared model — Assets → Checks → Findings →
Tasks with module = "easm" — and is served over the
Platform API. The finalization pass (severity,
classification, knowledge base, dedup, lifecycle) is shared across all modules.
See Guardrails & Access for what EASM will and won't touch.