Define the authorized scope
Begin with domains and other assets that the organization owns or is authorized to assess. Set boundaries for any active testing and document exclusions.
Discover and connect assets
Review DNS records, certificates, IP relationships and known application endpoints. Discovery produces leads that should be checked for ownership before they become part of an inventory.
Review, prioritize and repeat
Record exposures, validate their relevance, and rank them using severity and business context. Repeat the process to detect changes and confirm that previous issues were addressed.
Put the guidance into practice
ASWEEP helps frame an authorized external assessment around asset visibility, exposure review and actionable reporting. Discuss your scope and goals before deciding which methods are appropriate.
Request a Security AssessmentFurther reading
For technical guidance, see the OWASP Web Security Testing Guide and CISA security resources. These external resources are provided for context.