The first job of any External Attack Surface Management tool is discovery, and it is the part that earns its keep before anything else. You cannot secure an asset you do not know you own, and the uncomfortable truth is that most organisations own a great deal they have lost track of. Discovery is the work of finding all of it, starting from almost nothing.
Starting from a Seed
Discovery usually begins with a seed: a company name, a primary domain, a known IP range. From that small starting point the tool expands outward, and the techniques it uses are the same ones an attacker would reach for. It queries certificate transparency logs, the public record of every TLS certificate issued, which quietly reveals subdomains the moment anyone requests a certificate for one. It walks DNS records. It searches registration data for other domains owned by the same organisation. It fingerprints IP ranges. Each result becomes a new seed, and the map grows.
The strength of this approach is that it does not rely on your asset register being complete. In fact it assumes the opposite. It finds things because they are observable from the outside, not because someone remembered to write them down.
Shadow IT and the Forgotten Estate
What discovery tends to surface falls into a few familiar categories. There is shadow IT: assets stood up by a team without going through central approval, entirely legitimately, and entirely unknown to security. There is the forgotten estate: the campaign site from three years ago, the staging server that was meant to be temporary, the acquired company’s infrastructure that was never folded in. And there are the dependencies: the third-party services your assets point at, the suppliers whose code your pages load.
None of these is exotic. They are the ordinary sediment of an organisation that has existed for a few years and moved quickly. But each is an asset that is exposed, unmonitored and unpatched, precisely because nobody knows it is there to monitor or patch.
Discovery Is Not the Same as Certainty
A good tool casts wide, and a wide net catches things that are not yours. A subdomain that resolves to a shared platform, an IP in a range you no longer use, a domain with a similar name owned by someone else entirely: discovery will surface these, and it is on you to confirm ownership before acting. The NCSC makes this point well: the value comes from combining the technical insight the product provides with your own knowledge of how the business actually works. The tool finds candidates. You decide what is really yours, and what an anomaly means.
This is also where discovery quietly improves your organisation beyond security. An accurate, continuously updated inventory of internet-facing assets is useful to far more than the security team, and many organisations find the map itself becomes the reference nobody had before.
Then It Has to Keep Going
The final thing to understand about discovery is that it is never finished. An asset inventory is accurate for about as long as it takes someone to deploy something new, which in a busy organisation is measured in hours. A one-off discovery scan is a snapshot that is out of date almost immediately. This is why discovery and monitoring are really the same capability seen over different timescales, and why the continuous part of the name matters as much as the discovery part.
The Short Version
Discovery finds your internet-facing assets by starting from a seed and expanding outward through certificate logs, DNS and registration data, exactly as an attacker would. Its value is finding the shadow IT and forgotten estate that no asset register contains. It surfaces candidates, not certainties, so ownership still has to be confirmed, and because the surface changes constantly, discovery only works if it never stops.