Six attack surface management assumptions checked against vendor documentation

Assumption 1: every ASM tool needs a list of your domains

Partly true. Censys ASM starts from seeds, known public-facing assets you add, and expands from them. Microsoft Defender EASM also works from seeds but offers a prebuilt inventory for many organizations. Others ask for less: CyCognito says the organization's name is its only required input, and watchTowr says it starts from a domain name. IONIX states immediate time to value but does not publish its inputs on the pages we reviewed. See how discovery works.

Assumption 2: a critical CVSS score means drop everything

Not on its own. FIRST describes CVSS as a measure of a vulnerability's severity. It does not say whether the flaw is exploited or whether your instance is reachable. FIRST's June 2026 forecast makes the point with numbers: CVE volume is projected at about 66,000 for the year, yet actionable exploitability remains flat when filtered for CISA KEV entries or EPSS scores above 10%. Severity is one input to prioritization, not the whole of it.

Assumption 3: ASM tools only produce lists

Not all of them. In their own documentation, IONIX and watchTowr describe pushing mitigation rules to WAFs and edge platforms, and Cortex Xpanse describes Active Response automated playbooks. CyCognito and Hadrian describe guidance, tickets and a retest after the fix. Other tools in our set document tickets or downstream automation. Our findings table on the score matrix records, for each tool, whether a finding arrives with an owner, proof, a ticket, a compensating control and a retest.

Assumption 4: validation means a penetration test

Validation covers a range of methods, and vendors describe theirs differently. IONIX describes non-intrusive exploit simulations. CyCognito says it runs more than 100,000 unauthenticated black-box tests without brute force or state changes. watchTowr describes automated red teaming with eight attack agents. Hadrian describes agentic AI that simulates attacks, and sells NOVA penetration tests separately. Each is a way to confirm exploitability, with different levels of intrusiveness. Ask what traffic a test sends to production. See what validation proves.

Assumption 5: you cannot learn anything about price before a sales call

Mostly true, with exceptions. Hadrian publishes from 1,250 euros per NOVA test, excluding VAT. Microsoft Defender EASM publishes what it bills for and offers a 30-day free trial. CyCognito publishes its pricing basis and a stated 24-hour quote response. IONIX, watchTowr and Cortex Xpanse publish no pricing, Tenable ASM and Censys ASM are quote or contact sales, and Rapid7 publishes a trial but no price. Our pricing note sets out the detail.

Assumption 6: vendor percentages let you compare tools

They do not. IONIX says it finds 30% to 50% more assets, CyCognito says up to 20 times more exposures, Hadrian cites 99% noise elimination and watchTowr a 0.01% false-positive rate. Each figure is the vendor's own, measured on its own terms and against its own baseline. We report them as claims and do not score them. The only comparison that settles an asset count is the same input, on your own estate, for every vendor on the shortlist, as the buyer's guide describes.

What should you take from this?

Read the documentation, not the category label. Two tools that both call themselves ASM can differ on every stage after discovery. Our compare page puts every documented capability side by side for any two to five tools.

Three questions cut through most of these assumptions in a first call: what do you need from us to start, what does a finding arrive with, and how is the price calculated. A vendor that answers all three in writing, with a public source or a demonstration on your estate, has told you more than any category label. Our FAQ collects the short answers for all nine tools we score.