Cloud EASM & Assets

Cloud EASM (External Attack Surface Management) maps everything you expose to the internet by talking directly to your cloud providers' APIs. Unlike passive internet scanning, it uses authenticated cloud API discovery - you connect a provider, and TurboPentest enumerates the real resources in your account. Discovery is free: you only spend credits when you actually run a pentest.

Connect a provider

Connect any of the 9 supported providers from Dashboard > Assets via OAuth or an API connection:

Once connected, TurboPentest reads your account and inventories the resources that make up your external attack surface.

What gets discovered

Discovery enumerates the internet-facing resources in your connected accounts. For AWS, for example, this includes:

• EC2 instances
• Application and Network Load Balancers (ALB/NLB)
• CloudFront distributions
• API Gateway endpoints
• AppSync APIs
• Lambda function URLs

Equivalent resource types are discovered across the other providers. Each discovered resource becomes an asset in your inventory.

Asset sync: new and removed assets

TurboPentest runs a periodic asset sync that re-queries each connected provider and diffs the latest snapshot against your last-known inventory. The diff flags:

• New assets - resources that appeared since the last sync
• Removed assets - resources that no longer exist in the provider

When the surface changes, you get a notification via Slack or email so a newly exposed asset never goes unnoticed.

Exposure scoring

Every asset carries an ExposureTier that reflects how reachable and sensitive it is:

Exposure escalates when sensitive services are reachable on public ingress ports, pushing an asset toward the at-risk tier so you can triage it first.

Verified assets and one-click pentests

Assets discovered through an authenticated cloud connection are cloud-verified: because you proved ownership by connecting the provider account, TurboPentest trusts them for scanning without a separate DNS check. This complements DNS TXT domain verification - either path establishes that you own the target.

A verified asset feeds a one-click pentest: launch a scan straight from the asset in your inventory, or reference it by assetId when starting a pentest via the API.

curl -X POST https://turbopentest.com/api/pentests \
  -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "assetId": "asset_123",
    "tier": "deep"
  }'

Asset sharing

A verified asset can be shared with another account. The receiving account can accept or decline the share. This lets teams and partners collaborate on the same attack surface - for example, sharing a verified asset with a security vendor account that runs pentests on your behalf.