Skip to content
Exposure Management FinderExposure Finder

VENDOR NOTES

ASM and exposure management vendor notes: facts, strengths and limits

SHORT ANSWER

Ten vendors, each written up from its own public pages read in September 2026 and updated on 11 October 2026: which of the five tool types it describes, how it proves exploitability, whether it works with WAFs and edge controls, what it publishes about price, and its strengths and limits. Notes are listed alphabetically and carry no scores.

By The Exposure Desk · Exposure Management Finder · Published 2026-10-11

Desk research from public vendor pages read in September 2026, updated 2026-10-11. Profiles follow our published method; we did not run the products.

Which vendors have notes?

  • Censys ASM shape: described for 3 of 5 tool types, not in our sources for 2.EASMVALPLATCTEMWAF

    Censys's external exposure management product, built on first-party scanning of all 65K ports and the Censys Internet Map.

    Safe checks:PartlyAttack-style:Not in our sources

    ASM: contact sales. A free Censys platform account exists, and credits start at $100.

    Read the notes

  • Cortex Xpanse

    Palo Alto Networks

    Cortex Xpanse shape: described for 3 of 5 tool types, not in our sources for 2.EASMVALPLATCTEMWAF

    Palo Alto Networks' attack surface management product, built on internet-wide scanning and automated response playbooks, sold within the Cortex portfolio.

    Safe checks:Not in our sourcesAttack-style:Not in our sources

    Not published by Palo Alto Networks. Reseller listing (UK G-Cloud 14, KHIPU Networks): £70,850.84 an instance a year, no free trial, public-facing attack surfaces only.

    Read the notes

  • CrowdStrike EASM

    CrowdStrike

    CrowdStrike EASM shape: described for 3 of 5 tool types, not in our sources for 2.EASMVALPLATCTEMWAF

    CrowdStrike's external attack surface management, now sold under the Falcon Exposure Management brand, with internet-wide scanning, adversary intelligence and an Exposure Prioritization Agent.

    Safe checks:Not in our sourcesAttack-style:Not in our sources

    Not published

    Read the notes

  • CyCognito

    CyCognito

    CyCognito shape: described for 5 of 5 tool types.EASMVALPLATCTEMWAF

    An external exposure management platform that starts from your organisation's name, attributes each asset to a subsidiary or brand, and runs more than 100,000 active security tests.

    Safe checks:MatchesAttack-style:Matches

    AWS Marketplace, 12-month contract: CyCognito ASM 250 (up to 250 assets) $30,000; 24- and 36-month contracts save up to 8% and 11%. Direct pricing basis: total asset volume (ASM); active IPs and web applications (exposure validation), by quote.

    Read the notes

  • Hadrian

    Hadrian

    Hadrian shape: described for 4 of 5 tool types, not in our sources for 1.EASMVALPLATCTEMWAF

    An agentic AI platform for attack surface management and penetration testing, with continuous external exposure management (ATLAS) and priced agentic penetration tests (NOVA).

    Safe checks:MatchesAttack-style:Matches

    NOVA agentic penetration test: from 1,250 euros per test excluding VAT, bundles available. ATLAS on AWS Marketplace, 12-month contract: up to 250 assets (domains, IP addresses and certificates) $50,000.

    Read the notes

  • IONIX

    IONIX

    IONIX shape: described for 5 of 5 tool types.EASMVALPLATCTEMWAF

    An ASM and exposure management platform that maps subsidiaries and the digital supply chain, validates exploitability with non-intrusive tests, and invokes compensating controls such as WAF rules, with humans approving what agents do.

    Safe checks:MatchesAttack-style:Partly

    AWS Marketplace, 1-month contract, per month: Silver Plan (monthly monitoring) $25,000; Gold Plan (weekly monitoring) $35,000; Platinum Plan (continuous monitoring) $45,000. 12-, 24- and 36-month contracts are offered, with savings of up to 10% (24 months) and 20% (36 months). Sold as SaaS by IONIX.IO.

    Read the notes
  • Microsoft Defender EASM shape: described for 2 of 5 tool types, not in our sources for 3.EASMVALPLATCTEMWAF

    Microsoft's external attack surface management service, run as an Azure resource, with a prebuilt inventory, recursive discovery from seeds and billing on the Azure bill.

    Safe checks:Not in our sourcesAttack-style:Not in our sources

    Billed through Azure on billable assets (approved host:IP combinations, domains and IP addresses) after a 30-day free trial. Microsoft's pricing page did not show a rate when we read it; check it for the current figure.

    Read the notes
  • Rapid7 Surface Command shape: described for 4 of 5 tool types, not in our sources for 1.EASMVALPLATCTEMWAF

    Rapid7's attack surface product, combining external discovery (EASM) with a unified internal and external asset inventory (CAASM), part of the Rapid7 Command platform.

    Safe checks:PartlyAttack-style:Not in our sources

    Trial available. Price not published. Exposure Command comes in Essentials and Ultimate tiers.

    Read the notes
  • Tenable Attack Surface Management shape: described for 4 of 5 tool types, not in our sources for 1.EASMVALPLATCTEMWAF

    Tenable's attack surface management, part of the Tenable One exposure management platform, drawing on an attack surface map of more than 5 billion assets.

    Safe checks:PartlyAttack-style:Not in our sources

    Not published

    Read the notes

  • watchTowr

    watchTowr

    watchTowr shape: described for 5 of 5 tool types.EASMVALPLATCTEMWAF

    A continuous automated red teaming platform that watchTowr calls Preemptive Exposure Management, with rapid reaction testing when a new threat emerges and mitigation rules pushed to the network edge.

    Safe checks:MatchesAttack-style:Matches

    Not published

    Read the notes

Which head-to-heads are available?

Censys ASM

Cortex Xpanse

CrowdStrike EASM

CyCognito

Hadrian

IONIX

Microsoft Defender EASM

Rapid7 Surface Command

Tenable Attack Surface Management

Which adjacent tools publish prices?

Two vulnerability scanning vendors with attack surface monitoring publish list prices. They are not profiled or used in the finder because their pages describe scanning rather than the five tool types in full.

  • Intruder

    Scans external and internal infrastructure, web apps, APIs, cloud and containers; the Enterprise plan adds automated shadow IT and unknown asset discovery. Prices (excluding VAT): Free $0 for 5 infrastructure targets; Cloud $239 a month or $2,870 a year; Pro $399 a month or $4,790 a year; Enterprise custom. AI web app pentests from $3,500 per test. 14-day free trial.

    Source: Intruder pricing · Read 11 Oct 2026

  • Detectify

    Surface Monitoring for discovery and vulnerability testing across the attack surface, plus application, API and internal scanning. Annual platform fee from: Starter €0, Standard €2,500, Professional €5,000, Enterprise €15,000; Surface Monitoring adds a cost per domain.

    Source: Detectify pricing · Read 11 Oct 2026

Questions readers ask

Why are the vendors not ranked?

Because the right vendor depends on your subsidiaries, hosting, current platform, need for proof, WAFs and capacity to fix. The finder applies those constraints; a single ranking would hide them.

Which vendors publish a price or pricing basis?

CyCognito, Hadrian and IONIX publish a price; Censys ASM, Cortex Xpanse, Microsoft Defender EASM and Rapid7 Surface Command publish a pricing basis, a trial or a free account; the other 3 quote through sales.

Why is CrowdStrike EASM's profile thinner?

We could read one CrowdStrike page for it, which describes discovery, prioritisation and guided remediation. Where that page is silent we write Not in our sources, which counts zero in the finder.