Skip to content
Exposure Management FinderExposure Finder

FIVE TOOL TYPES

Exposure management tool types: EASM, validation, platforms, CTEM and WAF posture

SHORT ANSWER

Exposure tools sort into five types by the job they do: finding internet-facing assets (EASM discovery), proving which exposures are exploitable (exposure validation), joining external and internal data (exposure management platforms), running a repeating cycle from scoping to fixing (CTEM programme support), and keeping WAF protection in step with what is exposed (WAF posture). Most vendors here cover more than one type, so the useful question is which type your problem needs first.

By The Exposure Desk · Exposure Management Finder · Published 2026-10-11

Desk research from public vendor pages read in September 2026, updated 2026-10-11. Profiles follow our published method; we did not run the products.

What does each tool type do?

  • EASM

    EASM discovery

    Finds the internet-facing assets you own, including ones nobody listed, and ties each to an owner.

    Described by 10 of 10 vendors

    Read the EASM guide
  • VAL

    Exposure validation

    Tests which exposures an attacker could actually exploit, from safe checks to continuous attack-style testing.

    Described by 7 of 10 vendors

    Read the VAL guide
  • PLAT

    Exposure management platforms

    Puts external findings next to internal vulnerability, cloud and asset data in one platform.

    Described by 8 of 10 vendors

    Read the PLAT guide
  • CTEM

    CTEM programme support

    Supports a continuous cycle of scoping, discovery, prioritisation, validation and getting fixes done.

    Described by 10 of 10 vendors

    Read the CTEM guide
  • WAF

    WAF posture

    Checks which assets your web application firewalls actually protect and turns new vulnerabilities into rules.

    Described by 3 of 10 vendors

    Read the WAF guide

Which vendor describes which tool type?

  • Outer point: described on the vendor's pages we read
  • Inner point: not in our sources (it may exist; we did not find it)
From each vendor's own pages, read in September 2026 and updated on 11 October 2026. Not in our sources means we did not find it; it may exist.
VendorShapeEASM discoveryExposure validationExposure management platformsCTEM programme supportWAF posture
Censys ASMCensys ASM shape: described for 3 of 5 tool types, not in our sources for 2.EASMVALPLATCTEMWAFDescribedDescribedNot in our sourcesDescribedNot in our sources
Cortex XpanseCortex Xpanse shape: described for 3 of 5 tool types, not in our sources for 2.EASMVALPLATCTEMWAFDescribedNot in our sourcesDescribedDescribedNot in our sources
CrowdStrike EASMCrowdStrike EASM shape: described for 3 of 5 tool types, not in our sources for 2.EASMVALPLATCTEMWAFDescribedNot in our sourcesDescribedDescribedNot in our sources
CyCognitoCyCognito shape: described for 5 of 5 tool types.EASMVALPLATCTEMWAFDescribedDescribedDescribedDescribedDescribed
HadrianHadrian shape: described for 4 of 5 tool types, not in our sources for 1.EASMVALPLATCTEMWAFDescribedDescribedDescribedDescribedNot in our sources
IONIXIONIX shape: described for 5 of 5 tool types.EASMVALPLATCTEMWAFDescribedDescribedDescribedDescribedDescribed
Microsoft Defender EASMMicrosoft Defender EASM shape: described for 2 of 5 tool types, not in our sources for 3.EASMVALPLATCTEMWAFDescribedNot in our sourcesNot in our sourcesDescribedNot in our sources
Rapid7 Surface CommandRapid7 Surface Command shape: described for 4 of 5 tool types, not in our sources for 1.EASMVALPLATCTEMWAFDescribedDescribedDescribedDescribedNot in our sources
Tenable Attack Surface ManagementTenable Attack Surface Management shape: described for 4 of 5 tool types, not in our sources for 1.EASMVALPLATCTEMWAFDescribedDescribedDescribedDescribedNot in our sources
watchTowrwatchTowr shape: described for 5 of 5 tool types.EASMVALPLATCTEMWAFDescribedDescribedDescribedDescribedDescribed
Vendors describing it1078103

How do the tool types fit together?

The five types are steps in the same chain. Discovery tells you what you have. Validation tells you which of it an attacker could use. A platform puts that next to everything else you know about your assets. A CTEM programme decides the order of work and checks that it gets done. WAF posture is one of the fastest ways to act on a finding while a patch waits.

Most buyers already own part of the chain, usually a vulnerability scanner or a platform from Tenable, Rapid7, Palo Alto Networks or Microsoft. The gap is often in the middle: assets nobody listed, and proof of which findings matter. That is why the finder asks what you already run before it suggests a type.

A longer list is not the goal. The test of any tool here is whether the list you work through gets shorter and more certain, and whether something can be done about an exposure before the fix ships.

Questions readers ask

Is EASM the same as ASM?

EASM is the external part of attack surface management: assets reachable from the internet. Some vendors use ASM for the same thing, and some add internal assets under names such as CAASM. On this site, EASM discovery is the tool type and ASM is the wider category.

Which tool type should come first?

Discovery, if you are not sure what you own, especially with subsidiaries or acquisitions. Validation, if you already have a long list and too little time. The finder weighs this from your answers.

Why is WAF posture a separate type?

Because a WAF in front of an exposed application is often the quickest compensating control, but only if the WAF actually covers that asset and has a rule for the new vulnerability. Checking that across several WAF vendors is its own job.