How we score attack surface management tools
Scored September 2026 · CrowdStrike EASM added 13 October 2026 · Drawn from vendor product pages, docs and public pricing
Quick answer
Each tool gets a whole-number score from 0 to 10 on seven criteria, with a written reason for every score. The weighted total uses published weights that favor discovery and remediation (20% each). Scores come from public vendor documentation, not hands-on testing.
What are the seven criteria and their weights?
| Criterion | Code | Weight | What we look for |
|---|---|---|---|
| Discovery of unknown assets and subsidiaries | DIS | 20% | Finds internet-facing assets the security team did not list, including shadow IT, acquired companies and subsidiaries, and third-party dependencies, with few or no inputs. |
| Attribution accuracy and false-positive handling | ATT | 15% | Shows why an asset belongs to you and which entity or owner it belongs to, and gives a way to handle doubtful matches. |
| Exploitability validation | VAL | 15% | Confirms that an exposure can actually be exploited, safely, rather than inferring risk from a version string or a severity score. |
| Remediation and mitigation support | REM | 20% | What a finding arrives with (owner, guidance, ticket) and whether the tool can apply a compensating control, retest a fix, or otherwise shorten the time to closure. |
| Integrations and platform reach | INT | 10% | Named connections to ticketing, SIEM, SOAR, cloud, CMDB and edge controls, plus the breadth of the platform the tool sits in. |
| Time to value | TTV | 10% | How little a buyer must supply to see results (company name, a domain, seeds), plus public trial or free-report options. |
| Pricing transparency | PRC | 10% | Whether a buyer can model cost before a sales call: list prices, a published pricing basis, trial terms. |
How is a score decided?
We read each vendor's product pages, documentation, pricing and integration pages in September 2026. For every criterion we asked what the vendor documents publicly, then scored it against the others in the set. A 9 or 10 means the capability is described specifically and goes further than most of the set. A 5 means it is present in general terms or only through another product. A 2 or 3 means we found little or nothing. Where a vendor makes a quantitative claim (for example a percentage more assets found or fewer false positives), we report it as the vendor's claim and do not score it as fact.
CrowdStrike EASM (formerly Falcon Surface) was added on 13 October 2026, scored from CrowdStrike's EASM and Exposure Management pages, data sheet and pricing page, read that day.
The weighted score is the sum of each criterion score multiplied by its weight, divided by 100. It is computed by the site from the published scores, not typed in, so the totals always match the table. We show two decimals so that close results are not hidden by rounding. Identical totals are shown as ties.
Why these weights?
Buyers in this category describe the same frustration: tools that return long lists without telling them what is exploitable, who owns it or how to close it. We therefore weight remediation and mitigation support as heavily as discovery, and give attribution and exploitability validation 15% each. Integrations, time to value and pricing transparency matter to procurement and carry 10% each. Different weights would produce a different order; the full matrix lets you apply your own.
What does "Not documented" mean?
It means we did not find the capability on the vendor's public pages at the time of review. It does not prove the product lacks it. Vendors can send corrections to editors@attacksurfaceranked.com with a public source, and we update the data and the scores recompute.
What are the limitations?
- Public sources only. Every fact comes from vendor websites, documentation and pricing pages, and Gartner's public press releases, fetched in September 2026 (CrowdStrike EASM on 13 October 2026).
- No hands-on testing. We did not run trials, scans or proofs of concept.
- No vendor interviews or briefings.
- Vendor claims are reported as claims. Percentages such as "30%-50% more assets" (IONIX) or "20x more exposures" (CyCognito) are the vendors' own figures.
- Snapshot in time. Products change quickly in this category; each page shows its review date.
- Analyst recognition is mentioned only where the vendor's own page states it, and is not scored.
How often is this updated?
We re-check every price and headline capability each quarter and when a vendor announces a material change. The next scheduled review is December 2026. Each page shows its last review date.
Frequently asked questions
Are these scores based on testing?
No. They are an editorial assessment of public vendor documentation, last reviewed September 2026, with CrowdStrike EASM added 13 October 2026.
Can a vendor pay to change its score?
No. Scores change only when a public source shows a documented capability or price has changed.