Asset Discovery with Hostname Expansion for EASM Enhanced customers - September 22, 2026

Deeper attack surface visibility is coming to your Bitsight platform.

We're expanding asset discovery across Bitsight products, and it will change what the EASM Enhanced package customers see in their external attack surface.

Starting from September 22, 2026, over the next couple of months, the EASM Enhanced package customers will get significantly more comprehensive hostname coverage. That means Bitsight will surface risks that were previously invisible, giving you a more complete picture of your organization's true exposure.

What's changing

• New hosts with internet scan data expand the EASM Enhanced package customers’ attack surface discovery
• New findings from this expanded coverage carry a 9-month incubation period, giving the EASM Enhanced package customers time to review and remediate before they affect your Rating

Where will EASM Enhanced package customers see it?

The EASM Enhanced package customers will see new host assets and new findings appear in their account starting from September 22, 2026 on an ongoing basis for the next couple of months. This means they will be benefitting from additional findings in the following diligence risk vectors:

• SSL configuration
• SSL certificates
• Web application security
• Critical vulnerability management

What we need from the EASM Enhanced package customers

After the release on September 22, 2026, please keep an eye on their Incubation Findings view continuously, so you can review and remediate as needed.

Frequently Asked Questions

Is it possible to predict the Rating impact of the Incubation findings?

At this time, it is not possible to predict or preview the potential Rating impact of the Incubation Findings.

The weight of the Risk Vectors would be helpful for our customers assess the possible Rating impact:

• Critical Vulnerability Management: 20%
• SSL Configuration: 15% 
• SSL Certificates: 10%

Is this 9-month Incubation Period specific to each finding or is it a fixed date range tied to the released feature?

Let’s remember that the “Finding Incubation Period” is tied to the specific features (especially, tied to the Groma features that will bring systemic changes). 

• For the EASM Enhanced customers, the fixed date range is targeted to start on Sep 22, 2026 and go through June 28, 2027

So, the sooner the finding appears the longer it stays in incubation period. The findings that appear at a later time in this fixed date range will have less time in the incubation period.

What is the recommendation for the customers regarding how to prioritize the Incubation Findings?

• Open Incubation Period Findings
• Do not focus on the GOOD grade Incubation Findings, because they do not require any remediation actions.
• Focus on only FAIR/WARN/BAD grade Incubation Findings, because it is better to remediate them during Incubation Period to mitigate any Rating impact in future.

Can the Incubation Findings be remediated?

Yes, the Incubation Findings can be remediated and then rescanned to see if the remediation efforts worked successfully. The rescan does not guarantee the finding replacement due to different behaviour of each risk vector. 

Why should Bitsight customers pay attention to the Findings in Incubation Period?

Findings that are in the incubation period are valid findings and they are displaying the correct grades without impacting the risk vector grade until the incubation period ends. We recommend our customers review and remediate these findings while the incubation period is active to mitigate any issues and threats in their security.

How can the customers identify the new Findings arriving in the Incubation Period?

Findings arriving from this release can be identified by using two different filter sets:

• First one is under “Impacts Risk Vector Grade” listed as “No: Incubation & Active” filter
• Second one is under “Bitsight Views” listed as “Incubation Period Findings”

Will there be a new finding alert available for the Findings in Incubation?

Bitsight customers can set up a new finding alert using the “Incubation Period Findings”  Bitsight View that is listed under Finding Alert Options Quick Settings.

Can the findings arriving in Incubation Period be identified through API? If so, which identifier the customers should look for?

Yes. The findings in Incubation Period can be identified through API. The field is impacts_risk_vector_details and the value is INCUBATION_PERIOD

How will the incubation period findings play into forecasting or RRPs?

Currently, these findings will not show up in Forecasting or RRPs until they become ratings impacting.

Will the incubation period findings appear in the asset risk matrix?

No, they will not appear on the asset risk matrix.

While the findings are in incubation period, will they be visible to third parties (the organizations monitoring the customer)?

Yes. The findings in the Incubation Period will keep having the same third party visibility as any other finding today.

How come the similar finding can be both in Rating Impacting and in Incubation Period at the same time, especially in SSL Configuration and SSL Certificate Findings?

• It is normal to see the same asset having a Rating Impacting finding in addition to the Incubation finding. Because, in order to ensure resiliency of the Bitsight product and minimize disruption in any type of data outages, there are several data sources bringing information into the product. 
• In Rating Impacting findings, the observations from these data sources consolidated and the one bringing the most recent observation arrives at the product as a Rating Impacting finding. 
• In terms of the Incubation Findings, since the Groma scan results are collected in a different pool in order not to impact the Rating during Incubation Period, when the asset is displayed under the Findings Table without the “Impacts Risk Vector Grade = Yes” filter, the list of findings displays both the Rating Impacting finding and the Incubation finding for the same asset. 
• After the Incubation Period ends, the findings will follow their usual workflow. So, the observations will be consolidated again and the one bringing the most recent observation arrives at the product as a Rating Impacting finding.