From finding to fix: how ASM remediation works

What should a finding arrive with?

Three things: the person or team that owns the asset, guidance on what to change, and a ticket in the system that team already uses. Most tools in our ranking document ticketing integrations. IONIX lists Jira, ServiceNow, Splunk, Microsoft Azure Sentinel, Cortex XSOAR and Slack among others. CyCognito lists ServiceNow, Jira, Splunk and Zendesk. watchTowr lists Atlassian, ServiceNow, Freshworks, Ivanti, Linear, PagerDuty, Torq and Zendesk. Hadrian lists Jira, ServiceNow, GLPI, Slack and Microsoft Teams.

What happens when the fix cannot ship this week?

Use a compensating control: a measure that reduces risk while the flaw remains. For web applications that usually means a WAF rule, known as a virtual patch. IONIX states it can turn a CVE into a deployable WAF rule within 12 hours of publication. watchTowr pushes Active Defense rules to edge platforms. Cortex Xpanse runs Active Response playbooks.

Some assets should not be fixed but removed or reclaimed: a subdomain pointing to a deleted resource, an expired domain, an abandoned cloud bucket. IONIX's Active Protection says it claims such assets on the customer's behalf.

How do you know it is fixed?

Retest. CyCognito documents a retest after the fix, and Hadrian documents automatic regression testing. Where a tool does not, schedule a manual check. Track mean time to remediate for each owner, not only across the whole program.

On our remediation criterion, IONIX and watchTowr score 9, Cortex Xpanse 8, CyCognito and Hadrian 7, Tenable ASM, Rapid7 Surface Command and CrowdStrike EASM 6, Censys ASM 5 and Microsoft Defender EASM 4. See the score matrix.