Twelve questions to ask in any exposure management demo

Why the same questions for everyone?

Each vendor will lead with its strongest feature. If you let the demo set the agenda, you compare strengths and miss gaps. The finder records twelve checks for every vendor from their public pages; here they are as questions you can ask in person.

Attribution and reach

1. Subsidiaries: show me how you attribute an asset to a subsidiary or business owner, and the evidence for one doubtful match.
2. Internal assets: do you see internal assets as well as external ones, and from which sources?
3. Cloud: which cloud providers and cloud security tools do you connect to, by name?

Proof

1. Safe checks: how do you confirm exploitability without changing the target?
2. Attack-style testing: do you prove impact the way an attacker would, and how do you keep it safe on production?
3. Retests: when we fix something, do you test again automatically?

Acting on findings

1. One WAF or edge vendor: can you produce or push a rule to the WAF or CDN we use?
2. Several WAF vendors: can you show which of our applications each WAF protects, and which none does?
3. Routing: how does a finding reach the owner, and in which ticketing tools?
4. Compensating controls: can you apply a control for us, and who approves it?

Cost and start

1. Price: what is the pricing basis, and is there a published price? CyCognito publishes its pricing basis, Hadrian a per-test price for its agentic tests, and Microsoft defines billable assets for Defender EASM.
2. Trial: can we start without a sales cycle? Microsoft Defender EASM has a 30-day free trial and Rapid7 lists a public trial for Surface Command.

What does a good answer look like?

Specific, shown on your data or a realistic example, and consistent with the vendor's own public pages. If an answer contradicts what a vendor's pages say, ask which is current. If a vendor shows something its pages do not describe, ask for documentation and send it to us through the contact page so we can update its notes.

What next?

Use Facts in columns to see what each vendor's pages already answer, and focus the demo on the rest.