Attack Surface

Attack Surface Management (ASM) continuously discovers and monitors all potential access points across your organization's digital footprint. Sprocket uses a combination of automated open-source intelligence and human-driven testing to identify assets associated with your organization based on the “seed objects” you provided, examples include apex domains, CIDR blocks and IP Addresses.

This data is used for External Pentesting in two ways. Proprietary automation will run against any assets marked as CPT Scope = CPT (true) and Ownership = Confirmed, automation includes tasks that gather data for reconnaissance to populate more details in the ASM and tasks that execute attacks against organization. Automated tasks are called Attack Narratives, read more details here.

Reviewing your Attack Surface

The Summary page provides a high-level view of your external attack surface and how it has changed over the last 30 days. To access the Summary, select Summary from the left navigation under Attack Surface. [1]

Summary_7.20.2026.png

Each metric card displays the current count and 30-day change for a specific asset type. Clicking any card navigates to the corresponding asset view. The most important count to review is the New Assets. [2]

The Assets Over Time chart shows how your total asset count has changed over time, giving you visibility into growth or reduction in your attack surface.[3]

The Top 5 Origins for Asset Discovery chart shows the reconnaissance sources responsible for the most asset discoveries in your environment, reflecting the methods Sprocket uses to identify assets such as certificate transparency logs, DNS lookups, and brute force enumeration. [4]

Managing Assets

You can play a role in making sure the assets included in your ASM are accurate and authorized for testing.

CPT Scope

Assets marked as in scope are included in penetration testing. If a newly discovered asset should not be tested, you can exclude it from CPT scope.

To exclude an asset from CPT scope:

Select one or more assets using the checkboxes. [1]
Click the Actions dropdown. [2]
Select Exclude from CPT Scope. [3]

Exclude from CPT_7.20.2026.png

Ownership

Every asset in your attack surface has an Ownership Status that reflects Sprocket's confidence that the asset belongs to your organization. Ownership is determined by a confidence score, an automated metric calculated from discovery origin, business logic, and manual inputs from Sprocket testers or your team.

Ownership Values

Confirmed

The asset has been validated as belonging to your organization.

Disputed

The asset has been flagged as potentially not belonging to your organization.

Sprocket Review

The asset is under review by your Sprocket team, typically following a dispute.

Not Confirmed

Ownership has not yet been validated. Confidence may be low or inputs may be incomplete.

You can filter any asset type view by Ownership Status using the Ownership filter. See Asset Types for asset-specific views.

Confirming or Disputing Ownership

From the asset list (bulk or individual)

Select one or more assets using the checkboxes. [1]
Click the Actions dropdown.[2]
Select Dispute Ownership. [3]

From the individual asset side panel

Click an asset to open the side panel.
Scroll to Ownership Status.
Under the Client Review section**,** click Confirm to confirm ownership or Dispute if ownership is inaccurate. [1]

Dispute Ownership Slideout_7.20.2026.png

Scope and Ownership History

Every change to an asset's ownership status or CPT scope is logged automatically. This audit trail is visible to all users on the Details tab of the asset slideout for Domains, DNS Records, IP Addresses, and Web Assets.

Each entry records:

What the change was [2]
Who made the change [3]
When the change occurred [4]

This gives your team visibility into how your attack surface has been managed, helping you track decisions made across your organization and maintain an accurate scope over time.

Scope & Ownership History_7.7.2026.png

Web Application Credentials

For assets identified as web applications, you can add credentials to allow your Sprocket testing team to conduct authenticated testing. This applies to organizations that have contracted with Sprocket for Web Application Testing. Assets included in this project are identified by a WebApp badge in the CPT Scope column of the Web Assets tab.

Web Assets_7.20.2026.png

Credentials are stored securely and used only for authorized testing activities.

</aside>

To add credentials to a web application asset:

Navigate to Web Assets in the Attack Surface section.
Click a Web Asset record that has the WebApp badge to open the slideout.
Select the Credentials tab, then click Add New. [1]
Enter the following information: [2]
Click Save.

Add Web App Creds_7.20.2026.png

Multi-Factor Authenticator (MFA): No MFA

Table of Contents

Quick Links

Attack Surface Management (ASM)