Attack surface management FAQ

The continuous work of finding everything an attacker could reach, deciding what belongs to you, working out which exposures matter and getting them closed. See the lesson What ASM is.

ASM is the umbrella term. EASM discovers internet-facing assets from the outside; CAASM builds an inventory from the tools you already run. See ASM vs EASM vs CAASM.

Continuous threat exposure management, Gartner's term for a program that continually evaluates the accessibility, exposure and exploitability of assets. ASM tools supply much of its discovery and validation. See What is CTEM.

A safe test that confirms whether a specific exposure can be exploited on a specific asset, rather than inferring risk from a version number. See What validation proves.

Blocking exploitation of a vulnerability at a control point, usually a WAF, while the software fix waits. It shortens the exposure window but does not replace the patch. See Virtual patching with a WAF.

CVSS scores how severe a vulnerability is, EPSS estimates how likely it is to be exploited in the next 30 days, and CISA's KEV catalog lists vulnerabilities with reliable evidence of exploitation. None says whether your own asset is exploitable. See CVE, CVSS, EPSS and KEV. See CISA KEV and internet-facing assets.

Most vendors in our set do not publish ASM prices. Hadrian publishes from 1,250 euros per NOVA penetration test, excluding VAT, Microsoft Defender EASM bills through Azure on billable assets after a 30-day trial, and CyCognito publishes its pricing basis. The score calculator shows published figures only. See what ASM tools cost.

Microsoft Defender EASM offers a 30-day free trial and Rapid7 Surface Command a public trial. Hadrian offers a free external security report, and Censys offers a free platform account, although its ASM product is contact sales.

It varies. CyCognito says it needs only the organization's name, watchTowr starts from a domain name, Censys ASM starts from seeds you supply, and Microsoft Defender EASM offers a prebuilt inventory. IONIX does not publish its inputs on the pages we reviewed.

In their own documentation, IONIX and watchTowr describe pushing rules to WAFs and edge platforms, and Cortex Xpanse describes automated Active Response playbooks. CyCognito and Hadrian describe guidance, tickets and retests. See the findings table on the score matrix.

Four weeks is enough to compare discovery, attribution and the path from finding to owner, if every vendor gets the same starting input. See the buyer's guide.

First of ten at 7.70. It ties for the top score on discovery, attribution and remediation, and scores 2 on pricing transparency because it publishes no price, pricing basis or trial terms. See the IONIX review and IONIX alternatives.

Rank 2 of ten at 7.60. It has the highest time to value score (9), starting from the organization's name, but no automated mitigation is documented. See IONIX vs CyCognito.

Rank 3 of ten at 7.50. It ties for the top score on exploitability validation and remediation (9 each) and publishes no pricing. See the watchTowr review.

Rank 4 of ten at 7.10. It ties for the top validation score (9) and is the only tool in the set with a published per-test price. Subsidiary mapping is not documented. See the Hadrian review.

Rank 5 of ten at 6.80. It ties for the top integrations score (9) through Cortex XSOAR and Prisma Cloud; exploitability validation is not described on its product pages. See Cortex Xpanse alternatives.

Rank 6 of ten at 6.05. It ties for the top integrations score through Tenable One; the ASM product does not document exploit testing and is sold by quote. See the Tenable ASM review.

Rank 7 of ten at 6.00. It has the highest pricing transparency score (7) and a 30-day trial, and the lowest validation score (3). See the Microsoft Defender EASM review.

Rank 8 of ten at 5.95. It combines EASM with CAASM and has a public trial; no active validation is documented. See the Rapid7 Surface Command review.

Rank 9 of ten at 5.90. It scores 8 on integrations because it sits in the CrowdStrike Falcon platform; active exploit testing, owner attribution and an EASM price are not described. See the CrowdStrike EASM review.

Rank 10 of ten at 5.85. It scans all 65K ports first-party and scores 8 on integrations, but discovery starts from seeds and no exploitation testing is documented. See CyCognito vs Censys ASM.

Each tool gets a whole-number score from 0 to 10 on seven criteria, each with a written reason. The weighted total is the sum of each score times its published weight, divided by 100, computed by the site. See How we score.

No. Scores are an editorial assessment of public vendor product pages, documentation and pricing, scored September 2026. We did not run trials or interview vendors.

We re-check prices and headline capabilities each quarter and when a vendor announces a material change; the next scheduled review is December 2026. Send corrections with a public source to editors@attacksurfaceranked.com.