For years, attack surface management has meant one thing: looking at your company the way an attacker on the outside does. What domains do you own? What login portals, servers, and forgotten subdomains are exposed to the internet? That outside-in view is the foundation of Isaphia ASM + CTI, and it catches the doors and windows you didn’t know were unlocked.
But here’s the uncomfortable truth: attackers don’t stop at the front door. Once they get a foothold — a phished password, a vulnerable web app, an infected laptop — they’re inside your network. And the inside of most networks is a very different place from the polished perimeter. That’s the gap Internal ASM is built to close.
👉 New to ASM and CTI? Start with our plain-English primer: What is ASM? What is CTI? And Why You Need Both →
The Inside of Your Network Is Its Own Attack Surface
Think of external ASM as checking every door and window on the outside of a building. It’s essential — but it tells you nothing about what’s inside. And inside is where the real damage happens.
Once an attacker is past the perimeter, they don’t go straight for the crown jewels. They look around. They map the network, find the old server nobody patches, the file share with weak protocols, the workstation still running software from a decade ago — and they use those to move from one machine to the next until they reach something valuable. Security teams call this lateral movement. It’s how a single compromised laptop becomes a company-wide ransomware incident.
The problem is that most companies have no map of their own internal network. They know roughly what’s out there on the internet, but the inside is a fog — full of legacy systems, forgotten devices, and services that have been quietly running on default settings for years. You can’t defend what you can’t see, and inside the firewall, most organizations are flying blind.
What Internal ASM Does
Internal ASM extends the same outside-in discipline of attack surface management to the inside of your network. You deploy one or more lightweight collectors — small, safe agents — inside your environment. They quietly map what’s actually there and report it back to your Isaphia dashboard:
- Assets — every device, server, and workstation the collectors can see on the internal network.
- Services — what each of those machines is actually running, and on which ports.
- Sites and collectors — so you can see coverage across multiple offices, data centers, or network segments.
- Findings — the part that matters most: the dangerous, exploitable problems hiding in plain sight, ranked by severity and tied automatically to the public vulnerability (CVE) that explains each one.
It’s the same idea that makes external ASM valuable — you can’t protect what you don’t know you have — pointed at the half of your attack surface that lives behind the firewall.
The Findings Attackers Are Counting On
This is where Internal ASM earns its keep. When the collectors map an internal network, they surface exactly the kind of weaknesses attackers look for first — the ones that make lateral movement easy:
- EternalBlue (MS17-010) — the wormable flaw behind WannaCry, still alive on unpatched legacy systems years later.
- BlueKeep (CVE-2019-0708) — a “wormable” Remote Desktop vulnerability that lets an attacker take over a machine with no password at all.
- SMBv1 still enabled — an ancient file-sharing protocol that should have been retired long ago, and a favorite highway for ransomware spreading machine-to-machine.
- Plaintext services like Telnet — logins sent across the network with no encryption, so anyone already inside can simply read the password as it goes by.
None of these would ever appear on an external scan, because they live inside the network. But to an attacker who’s already gotten in, they’re a gift — the difference between being stuck on one machine and owning the entire environment. Internal ASM finds them first, labels each one Critical or High, and correlates it to the known CVE so your team knows exactly what it is and why it matters.
One Picture: External, Internal, and What Attackers Already Know
Internal ASM is one layer of a larger picture. Isaphia ASM + CTI gives you all three in one place:
- External ASM — what you expose to the internet (the attacker’s way in).
- Internal ASM — what’s reachable once they’re inside (the attacker’s way around).
- CTI — what’s already being said, sold, or leaked about you on the dark web (what the attacker already knows).
An attack is rarely a single event. It’s a chain: a leaked password (CTI) used against an exposed login portal (external ASM) that gives an attacker a foothold they then use to pivot across a flat, unpatched internal network (internal ASM). Seeing only one link in that chain leaves you guessing about the rest. Seeing all three — in one dashboard — is what lets you break the chain before it reaches anything that matters.
What You Should Do
1. Map your inside, not just your outside
If you’ve already got visibility into your external footprint, the internal network is the obvious blind spot to close next. You almost certainly have more there than you think.
2. Hunt down the legacy systems first
EternalBlue, BlueKeep, SMBv1, plaintext logins — these are the findings that turn a small incident into a catastrophic one. Prioritize retiring or patching them above almost anything else.
3. Assume the perimeter will be breached
Modern security planning doesn’t assume the firewall holds. It assumes an attacker eventually gets in — and asks how far they can get once they do. Internal ASM answers that question with evidence instead of hope.
4. Make it continuous
Networks change every day — new devices, new services, a contractor’s laptop, a server spun up “just for testing.” A one-time look goes stale fast. Continuous internal discovery is what keeps the map honest.
The Bottom Line
Your firewall isn’t a wall — it’s a door, and doors get opened. The companies that weather an intrusion aren’t the ones who kept every attacker out forever; they’re the ones who could see their own network well enough to stop a foothold from becoming a disaster.
Internal ASM gives you that view. Not the polished outside the world sees — the real inside an attacker would, the moment they get past the perimeter.
How Isaphia Helps
Isaphia ASM + CTI sees your attack surface from every angle: what you expose to the internet, what’s reachable inside your network, and what attackers already know about you on the dark web — all in one dashboard, with every critical finding tied to the vulnerability that explains it.
You can see what’s exposed about your company right now, for free. No credit card. No sales call. Sign up and find out what attackers already see.
👉 Start your free trial at app.isaphia.com/signup
Isaphia is an attack surface management and threat intelligence platform that helps organizations discover, monitor, and protect their external and internal digital footprint — before attackers exploit it.