Bitdefender GravityZone EASM

Why do you need external attack surface management?

An attacker does not start from your inventory - they start from what they can see on the internet. A subdomain left over from a finished project that nobody remembers, a supplier portal with an open port, a certificate that expired overnight, a cloud instance spun up by a department outside IT: none of these has to be in the CMDB to become an entry point.

GravityZone EASM (External Attack Surface Management) reverses the perspective: instead of asking what the organization has registered for protection, it checks what is visible from the outside and scores which of those assets are the easiest to exploit. The result lands in the same GravityZone console you already use to manage risk on workstations and servers.

How does it work?

Agentless asset discovery

EASM scans from the Bitdefender cloud without installing anything on workstations, servers or network devices. The starting point is the organization’s identity - its domains and the assets tied to them - not a list you have to supply in advance:

• Domains and forgotten subdomains
• Public IP addresses and ASN records
• Cloud services and shadow IT launched without IT’s knowledge
• Open ports and publicly reachable services

Exposure assessment from the attacker’s perspective

Every discovered asset is checked for what would draw an attacker’s attention:

• Unpatched software on internet-facing services
• Misconfigured services
• Expiring and expired certificates
• Domains similar to yours, used for spoofing and fraud

Findings are scored by severity, so the team starts with the exposures an attacker would use first rather than with the longest list.

Continuous monitoring and alerting

The attack surface changes with every deployment, domain registration and migration. EASM monitors it continuously and raises an alert when a new vulnerability, a newly exposed asset, an expired certificate or a misconfiguration appears - before someone outside notices it.

Key features

Discovery and inventory

• Continuous, agentless discovery of internet-facing assets
• Identification of shadow IT and unmanaged assets
• ASN records, IP addresses, subdomains, cloud services
• Lookalike domain detection (brand impersonation)

Assessment and prioritisation

• Vulnerability identification on public services
• Detection of misconfigurations and open ports
• Certificate validity checks on external assets
• Severity score for every finding and alerts on critical changes

Compliance and reporting

• Compliance view: pick a standard or benchmark and see the assets affected by the risk
• One picture of internal (Risk Management) and external (EASM) risk in a single console
• Third-party exposure monitoring: suppliers, affiliates and partners

Inside-out vs. outside-in view

Question	Risk Management (inside-out)	EASM (outside-in)
What is installed on managed endpoints?	✓	-
What is visible from the internet, beyond the inventory?	-	✓
Requires an agent on the device	✓	-
Certificates and lookalike domains	-	✓
Supplier assets where nothing can be installed	-	✓
Shared GravityZone console	✓	✓

Licensing model and integrations

Licence form: EASM is a paid add-on, not a standalone product. It activates on top of a GravityZone base licence: Business Security Premium, Business Security Enterprise, GravityZone EDR cloud, Bitdefender MDR and GravityZone Cloud MSP Security.

For MSPs and MSSPs: the add-on runs on GravityZone MSP Security tiers in a multi-tenant model - one provider monitors the exposure of many clients from a single console.

Integration: EASM findings land in GravityZone Control Center and connect to the risk management workflow you already apply to workstations and servers.

Pricing: depends on the base licence and the number of monitored assets - an nFlo sales representative will prepare a quote for your specific environment.

Who is it for?

• CISOs with distributed domains and subsidiaries - a single picture of everything the organization exposes to the internet, including after acquisitions and across branches
• Security teams assessing suppliers - a technical check of partner exposure where you cannot install an agent
• MSPs and MSSPs - external attack surface monitoring for many clients from one console
• IT administrators - a list of exposed services and certificates to clean up before it appears in a penetration test report

How does GravityZone EASM support NIS2 and the KSC Act?

EASM adds the outside-in view to Article 21 of NIS2 and Article 8 of the Polish National Cybersecurity System Act (KSC Act) - two of the twelve areas whose full mapping we describe in our article on how GravityZone supports NIS2 and the KSC Act:

• Asset and exposure visibility - continuous, agentless discovery of domains, IP addresses, cloud services and shadow IT extends the inventory with assets the organization did not know about; the severity score shows which exposure to close first.
• Supply chain risk - third-party asset monitoring shows the exposure of suppliers, affiliates and partners where no agent can be installed; this is the technical part of a supplier assessment, not the whole of it - contract clauses and the review process stay with the organization.

Which of these areas is your gap is what we establish in the NIS2 Readiness Check service.

Who is in scope, deadlines and penalties are covered in our NIS2 knowledge hub. GravityZone does not replace an ISMS, formal risk management, audits or the organization’s own accountability for NIS2 and KSC Act obligations - it supports their technical side.

Why deploy with nFlo?

• We select the GravityZone base licence on which EASM makes sense in your environment
• We configure the monitoring scope: domains, subsidiaries, assets of the suppliers you name
• We turn EASM findings into an action plan within your vulnerability management process
• We connect the results with the NIS2 readiness assessment and nFlo’s other compliance services