Glossary · Security testing
What is Internal Attack Surface Management?
Also known as: iASM, Internal ASM
Internal Attack Surface Management (iASM) is the discovery and mapping of internal cloud and identity assets and the attack paths between them. It takes an inside-out view, modeling what an attacker could reach after gaining a foothold, so teams can find and cut the chains that lead to high-value targets.
Key takeaways
- iASM maps internal cloud, identity, and resource relationships from a post-foothold, inside-out perspective.
- Its focus is attack paths: the chains of privilege escalation and lateral movement that lead to crown-jewel assets.
- It complements external ASM, which stops at the internet boundary, by modeling what happens after initial access.
- iASM reveals true blast radius and prioritizes the choke points that cut the most attack paths.
What is Internal Attack Surface Management?
Internal Attack Surface Management assumes the perimeter has been crossed. Instead of asking what an attacker can reach from the internet, it asks: once someone has a foothold, what can they reach next, and how do they get to the data and systems that matter most? It maps internal assets, the identities and roles attached to them, and the permission relationships that connect one resource to another.
This is the inside-out counterpart to external attack surface management, which takes the outside-in view of internet-facing exposure. Together they cover both sides of the boundary: getting in, and moving once inside.
Mapping internal attack paths
The central output of iASM is the attack path: the chain of steps an attacker would take from an initial foothold to a high-value target. Building these paths requires modeling cloud resources, IAM roles and policies, trust relationships, and network reachability as a graph, then computing routes through that graph.
Two movements dominate those paths. Privilege escalation gains higher access than the attacker started with, and lateral movement pivots from one compromised resource to another. iASM finds where these combine into a viable route to sensitive data.
- Cloud accounts, resources, and their configurations
- Identity and access relationships (roles, policies, trust)
- Network reachability and segmentation between assets
- Computed attack paths from foothold to crown-jewel targets
From attack paths to remediation and evidence
Because iASM models the whole graph, it can identify choke points, the single permissions or misconfigurations that, if fixed, sever many attack paths at once. This makes remediation efficient and ties directly to least privilege and zero trust goals.
The mapped paths also become evidence: they demonstrate that segmentation and access controls actually constrain blast radius. Feeding iASM findings into continuous control monitoring turns a discovered attack path into an automatic control failure rather than a buried report.
Frequently asked questions
- How is iASM different from external ASM?
- External ASM is outside-in: it discovers and monitors internet-facing assets an attacker could target from outside. iASM is inside-out: it maps internal assets and the attack paths between them after a foothold is gained.
- Why model identity and permissions instead of just network connectivity?
- In cloud environments, most lateral movement and privilege escalation happens through IAM roles, policies, and trust relationships rather than open network ports. Mapping identity relationships reveals paths that pure network analysis misses.
- What is a choke point in an attack path graph?
- A choke point is a single permission, role, or misconfiguration that many attack paths pass through. Fixing one choke point can sever numerous paths to high-value targets at once, making it a high-leverage remediation.