METHOD
How we map ASM and exposure management tools to your answers
SHORT ANSWER
We read each vendor's public pages, record what they describe for five tool types and twelve practical checks, and apply published rules to your quiz answers. There are no scores or rankings. The same rules apply to every vendor.
By The Exposure Desk · Exposure Management Finder · Published 2026-10-11
Desk research from public vendor pages read in September 2026, updated 2026-10-11. Profiles follow our published method; we did not run the products.
What do we record for each vendor?
For each of the five tool types we record one of two statuses with a note and a source: Described (the vendor's pages we read describe it) and Not in our sources (we did not find it). We also record twelve checks: subsidiary and owner attribution, internal as well as external assets, cloud connections, safe exploitability checks, attack-style testing, work through a WAF or edge, WAF coverage across several vendors, retesting after a fix, routing to owners and tickets, applying a compensating control, a published price or pricing basis, and a trial or self-serve start. Each check is Matches, Partly or Not in our sources.
- Outer point: described on the vendor's pages we read
- Inner point: not in our sources (it may exist; we did not find it)
How does the finder weigh the tool types?
| Question | Answer | Points |
|---|---|---|
| How is your organisation put together? | One organisation with one main brand | EASM +2 |
| How is your organisation put together? | Several brands or business units | EASM +3, CTEM +1 |
| How is your organisation put together? | Many subsidiaries, or acquisitions in the last three years | EASM +5, CTEM +2 |
| Where do your internet-facing systems run? | Mostly public cloud | EASM +1 |
| Where do your internet-facing systems run? | A mix of cloud and on-premises | PLAT +2, EASM +1 |
| Where do your internet-facing systems run? | Mostly on-premises data centres | PLAT +3 |
| Which security platform or scanner do you already run? | None of these | EASM +1 |
| Which security platform or scanner do you already run? | Tenable · Rapid7 · Palo Alto Networks (Cortex XSOAR or Prisma Cloud) · Microsoft (Azure or Microsoft Sentinel) · CrowdStrike Falcon | PLAT +3 |
| Which security platform or scanner do you already run? | A vulnerability scanner from another vendor | VAL +2, CTEM +1 |
| How much proof do you need that an exposure is real? | A prioritised list is enough for now | EASM +1 |
| How much proof do you need that an exposure is real? | Safe, non-intrusive checks that it is exploitable | VAL +3, CTEM +1 |
| How much proof do you need that an exposure is real? | Attack-style testing that proves impact | VAL +5, CTEM +1 |
| What sits in front of your web applications? | No WAF or edge protection | Nothing |
| What sits in front of your web applications? | One WAF or CDN vendor | WAF +2 |
| What sits in front of your web applications? | Several WAF vendors across teams or subsidiaries | WAF +5, CTEM +1 |
| How much capacity does your team have to fix things? | Findings get fixed within our targets | VAL +1 |
| How much capacity does your team have to fix things? | The backlog grows faster than we close it | CTEM +3, VAL +1 |
| How much capacity does your team have to fix things? | We need fixes or compensating controls applied through tools we already own | WAF +3, CTEM +2 |
Types are ordered by points, highest first; ties keep the fixed order EASM, VAL, PLAT, CTEM, WAF. The first is Start here. Of the next two in that order, each is Also relevant if its points are at least 3, or half the first type's points if that is higher. Types with 0 points are Not suggested by your answers; the rest are Lower on your list.
How does the finder check vendors?
Each picked tool type (Start here and Also relevant) adds 2 when the vendor's pages describe it and 0 when it is not in our sources. Checks apply only when one of your answers triggers them.
| Check | When it applies | Matches | Partly | Not in our sources |
|---|---|---|---|---|
| Subsidiary and owner attribution | Organisation: several brands, or subsidiaries and acquisitions | 2 | 1 | 0 |
| Cloud connections named | Hosting: mostly public cloud | 2 | 1 | 0 |
| Internal as well as external assets | Hosting: mixed, or mostly on-premises | 2 | 1 | 0 |
| Exploitability checked | Proof: safe checks | 2 | 1 | 0 |
| Attack-style testing | Proof: attack-style testing | 2 | 1 | 0 |
| Works through your WAF or edge | WAF: one vendor | 2 | 1 | 0 |
| WAF coverage across several vendors | WAF: several vendors | 2 | 1 | 0 |
| Retests after a fix | Capacity: findings fixed within targets | 2 | 1 | 0 |
| Routes findings to owners and tickets | Capacity: backlog growing | 2 | 1 | 0 |
| Applies a compensating control | Capacity: controls applied through existing tools | 2 | 1 | 0 |
| Price or pricing basis published | Organisation: one brand | 2 | 1 | 0 |
| Trial or self-serve start | Organisation: one brand | 2 | 1 | 0 |
| Extends the platform you already run | The vendor sells the platform you already run | +4 | ||
| Connects to the platform you run | The vendor names an integration with the platform you run | +2 | ||
Vendors with the same total are shown as equals and listed alphabetically. We never show the total as a score.
What does Not in our sources mean, and is it fair?
It means we did not find the item on the pages we read. It counts zero, not against the vendor. It does affect order: a vendor whose pages describe a retest can match a retest check, and one whose pages do not cannot. Where this cuts against a vendor that offers more than its pages say, the fix is a source, not a guess: send it through the contact page and we will add it.
Which vendors are covered, and why these ten?
Ten vendors that sell attack surface management or exposure management products with public pages detailed enough to record: Censys ASM, Cortex Xpanse, CrowdStrike EASM, CyCognito, Hadrian, IONIX, Microsoft Defender EASM, Rapid7 Surface Command, Tenable Attack Surface Management and watchTowr. CrowdStrike EASM's notes rest on a single CrowdStrike page, so more of its entries read Not in our sources.
Where do the facts come from?
- Vendor product pages, documentation, pricing pages and press releases, all read in September 2026 and updated on 11 October 2026. Each fact on the site carries its source link and read date.
- Vendor figures such as asset counts, false-positive rates or time to remediate are quoted as the vendor's statement and are never our finding.
- Where a vendor does not publish a price, we write Not published.
- Statements about CTEM attributed to Gartner come from Gartner's public press releases of 16 October 2023 and 22 February 2024. We do not reproduce Gartner's subscriber research, and the cycle we describe on CTEM explained is our own plain-language description.
- Definitions of CVE, CVSS, EPSS and the CISA KEV catalog link to the public pages of FIRST and CISA.
What are the limitations?
Public sources only. No hands-on testing, no demos, no vendor interviews. A vendor's pages describe what it sells, not how well it works on your estate. Our notes on ten vendors are thinner in places than the vendors' full documentation, which is why the Not in our sources status exists. Use the finder to decide what to ask and what to put into a proof of concept, not as a test result.
How do we handle corrections?
Send a correction through the contact page with the topic Correction and a public source. We check it against the vendor's page and update the data; finder results recompute automatically.
Questions readers ask
Did you test these products?
No. Every fact comes from public vendor pages read in September 2026 and updated on 11 October 2026.
Can a vendor pay to appear first?
No. Order comes only from the published rules and your answers.
Why no scores?
Because the right tool depends on the shape of your problem more than on any single number. A score would hide the constraint that matters to you, such as a platform you already own or a WAF estate a tool cannot see.