ASM tools compared: the 2026 score matrix

DIS Discovery of unknown assets and subsidiaries

Its Connective Intelligence engine recursively maps internet-facing assets, including shadow IT, subsidiaries and third- and fourth-party assets in the digital supply chain.

ATT Attribution accuracy and false-positive handling

Automatically attributes each asset to the relevant subsidiary or business owner; IONIX's claim of fewer false positives is its own and not verified here.

VAL Exploitability validation

Confirms exploitability with non-intrusive exploit simulations; less aggressive than the attack-agent approaches documented by Hadrian and watchTowr.

REM Remediation and mitigation support

Turns new CVEs into deployable WAF rules for virtual patching, and its Active Protection claims hijackable domains and cloud buckets on the customer's behalf.

INT Integrations and platform reach

Names Jira, ServiceNow, Splunk, Microsoft Sentinel, Cortex XSOAR, Slack, Wiz and Prisma Cloud, and identifies WAFs from 50+ vendors; narrower than the platform suites.

TTV Time to value

States "immediate time-to-value" with minimal resources; the inputs needed to start are not published on the pages reviewed.

PRC Pricing transparency

No list price, pricing basis or trial terms published.

DIS Discovery of unknown assets and subsidiaries

Starts from the organization's name with no IP ranges or asset lists and covers subsidiaries, acquired-company infrastructure and third-party-connected systems.

ATT Attribution accuracy and false-positive handling

Every finding carries a trace of how it was found, why it belongs to the organization and who owns it.

VAL Exploitability validation

Runs more than 100,000 unauthenticated black-box security tests across more than 30 exposure categories, designed not to disrupt production.

REM Remediation and mitigation support

Step-by-step guidance per issue, owner-linked workflows and a retest after each fix; no automated mitigation is documented.

INT Integrations and platform reach

Names ServiceNow, Jira, Splunk and Zendesk among its integrations.

TTV Time to value

The organization's name is the only required input.

PRC Pricing transparency

Publishes its pricing basis (total asset volume for ASM; active IPs and web applications for exposure validation) and a quote form with a stated 24-hour average response; no list price.

DIS Discovery of unknown assets and subsidiaries

Reconstructs the external estate from a domain name, including unknown SaaS, subsidiaries and forgotten infrastructure.

ATT Attribution accuracy and false-positive handling

Maps discovered assets to subsidiaries, brands and M&A; the attribution evidence is described in less detail than at CyCognito or IONIX.

VAL Exploitability validation

Automated red teaming with eight agents: infrastructure, web application, known exploited vulnerabilities, credential stuffing, cloud, sensitive data, third party and supply chain, and DNS.

REM Remediation and mitigation support

Active Defense deploys mitigation rules to the network edge through WAF and firewall vendors including Cloudflare, Akamai, Imperva, F5, Fortinet, Check Point and Citrix.

INT Integrations and platform reach

Ticketing and workflow connections to Atlassian, ServiceNow, Freshworks, Ivanti, Linear, PagerDuty, Torq and Zendesk.

TTV Time to value

"Zero install", starting from a domain name.

PRC Pricing transparency

No pricing published.

DIS Discovery of unknown assets and subsidiaries

Continuous discovery of domains, subdomains, certificates and IPs, including shadow assets, with scans typically hourly or event-triggered; subsidiary mapping is not documented.

ATT Attribution accuracy and false-positive handling

Uses machine learning trained by ethical hackers to confirm asset ownership.

VAL Exploitability validation

Agentic AI simulates attacks and, by Hadrian's account, proves exploitability within 15 minutes.

REM Remediation and mitigation support

Actionable remediation guidance, automatic ticket creation and automatic regression testing after fixes; no edge mitigation documented.

INT Integrations and platform reach

Names Jira, ServiceNow, GLPI, Slack, Microsoft Teams, SentinelOne, Datadog, Zendesk and HubSpot, plus an API.

TTV Time to value

Offers a free external security report; onboarding inputs are not specified.

PRC Pricing transparency

Publishes a price for NOVA agentic penetration tests (from 1,250 euros per test excluding VAT, bundles available); ATLAS is priced by total asset count on request.

DIS Discovery of unknown assets and subsidiaries

Palo Alto Networks says Xpanse scans the full IPv4 space several times a day (4.3 billion addresses; 500 billion+ ports scanned daily).

ATT Attribution accuracy and false-positive handling

Identifies the relevant stakeholders for third-party exposures; subsidiary attribution detail is not published on the pages reviewed.

VAL Exploitability validation

Exploitability validation is not described on the product pages reviewed; the emphasis is discovery and response.

REM Remediation and mitigation support

Active Response runs built-in automated playbooks, with routing and remediation through Cortex XSOAR playbooks.

INT Integrations and platform reach

Native ties to Cortex XSOAR and Prisma Cloud inside the Palo Alto Networks Cortex portfolio.

TTV Time to value

Internet-wide scan data exists before onboarding; onboarding inputs and trial terms are not published.

PRC Pricing transparency

No pricing published.

DIS Discovery of unknown assets and subsidiaries

Draws on an attack surface map of more than 5 billion assets to identify domains related to the buyer's inventory.

ATT Attribution accuracy and false-positive handling

Adds business context from more than 200 metadata fields; subsidiary attribution is not described on the pages reviewed.

VAL Exploitability validation

Tenable One adds attack path analysis across 150+ techniques; the ASM product itself does not document exploit testing.

REM Remediation and mitigation support

Tenable One's Hexa AI engine orchestrates automated remediation workflows, which requires buying into Tenable One.

INT Integrations and platform reach

Feeds Tenable One alongside vulnerability, cloud, OT and identity exposure data, with Tenable One Connectors for third-party sources.

TTV Time to value

Demo request only; no ASM trial listed.

PRC Pricing transparency

ASM is quote-only, although Tenable publishes prices for adjacent products such as Tenable One Vulnerability Management.

DIS Discovery of unknown assets and subsidiaries

Offers a prebuilt inventory for many organizations and recursive discovery from seeds: domains, IP blocks, hosts, email contacts, ASNs and Whois organizations.

ATT Attribution accuracy and false-positive handling

Every asset carries a state (Approved Inventory, Dependency, Monitor Only, Candidate, Requires Investigation) based on connection strength and confidence.

VAL Exploitability validation

Dashboards cover vulnerabilities, compliance and security hygiene; no exploitability testing is documented.

REM Remediation and mitigation support

Remediation happens downstream after export to Log Analytics; no built-in remediation workflow is documented.

INT Integrations and platform reach

Data connectors to Log Analytics and Azure Data Explorer and a Security Copilot integration in preview; no cross-tenant resource access.

TTV Time to value

30-day free trial on the first resource, plus the prebuilt inventory.

PRC Pricing transparency

Self-serve Azure billing against a published definition of billable assets (approved hosts, domains and IP addresses) after the trial.

DIS Discovery of unknown assets and subsidiaries

Discovers unknown internet-facing and internal assets and shadow IT, combining external visibility (EASM) with a unified asset inventory (CAASM).

ATT Attribution accuracy and false-positive handling

Enriches assets from native and third-party sources; the attribution method is not described.

VAL Exploitability validation

Prioritizes exposures adversaries are most likely to exploit; no active validation is documented for Surface Command.

REM Remediation and mitigation support

Built-in automation and SOAR-ready integrations; remediation workflows, SLAs and reporting are listed for higher tiers.

INT Integrations and platform reach

Sits in the Rapid7 Command platform next to Exposure Command, InsightVM and InsightCloudSec.

TTV Time to value

Public self-serve trial.

PRC Pricing transparency

Trial published; no price.

DIS Discovery of unknown assets and subsidiaries

CrowdStrike says its internet mapping technology continuously indexes the entire internet and maps known and unknown assets, including shadow IT, 24/7; the inputs needed and subsidiary coverage are not described.

ATT Attribution accuracy and false-positive handling

Tracks added, modified and removed assets and flags business-critical ones with AI-driven analysis; how an asset is tied to the organization, a subsidiary or an owner is not described.

VAL Exploitability validation

Its Exposure Prioritization Agent "validates exploitability using real-time telemetry" and correlates internet-facing assets with internal systems; active exploit testing of external assets is not described.

REM Remediation and mitigation support

Guided remediation steps, ServiceNow and Jira ticketing, Falcon Fusion SOAR workflows and Falcon Real Time Response compensating controls, which require Falcon Insight XDR; no retest after a fix and no WAF or edge rule is described.

INT Integrations and platform reach

Sits in the CrowdStrike Falcon platform beside threat intelligence, IT hygiene and vulnerability management across endpoints, cloud, network and OT/IoT; ServiceNow and Jira are the named integrations.

TTV Time to value

CrowdStrike says Falcon Exposure Management gives instant visibility from day one, and its site offers a 15-day Falcon trial not tied to EASM; the inputs needed to start are not published.

PRC Pricing transparency

No EASM or Exposure Management price; CrowdStrike publishes per-device prices only for endpoint bundles, and no CrowdStrike EASM marketplace listing was found.

DIS Discovery of unknown assets and subsidiaries

First-party scanning across all 65K ports finds services on nonstandard ports and hosts with self-signed certificates; discovery expands from seeds the customer supplies.

ATT Attribution accuracy and false-positive handling

Assets found beyond the seeds appear under a "Found by Censys" tab; attribution logic is not described in detail.

VAL Exploitability validation

Confirms reachability and applies EPSS and KEV scoring; no active exploitation testing is documented.

REM Remediation and mitigation support

Auto-creates, routes and tracks remediation tasks through ticketing; no mitigation is documented.

INT Integrations and platform reach

Jira, ServiceNow ITSM and CMDB, Tenable VM, Google Security Operations, Microsoft Sentinel, Axonius, Brinqa, Slack, Webex, plus AWS, Google Cloud and Azure.

TTV Time to value

Needs seeds before discovery starts.

PRC Pricing transparency

A free Censys platform account exists; ASM itself is contact sales.