- Your CMDB and cloud inventory describe assets you provisioned. Attribution-based EASM tools find assets that exist because of acquisitions, forgotten DNS delegations, rogue cloud accounts, and subsidiaries that never reported to central IT.
- The delta between what internal inventory says and what an EASM scan returns is where most material exposure lives. Tools that cannot separate true positives from noise waste the time it takes to close that gap.
- Scan frequency and attribution confidence are the two variables that actually differentiate these platforms. Most comparison pages ignore both.
- Pricing at scale varies more than any other security tool category. Per-domain, per-asset, per-seed, and subscription-flat models produce radically different costs for a company with 20 subsidiaries versus a company with three.
- EASM is not the same as continuous threat exposure management (CTEM). EASM finds the surface. CTEM prioritizes and tracks remediation across it. Several vendors sell both under one roof, which matters when you are evaluating whether you need one contract or two.
The best external attack surface management tools for most enterprise teams are Palo Alto Cortex Xpanse, CyCognito, and Censys, selected for attribution depth, scan frequency, and false-positive controls. Microsoft Defender EASM fits organizations already running Microsoft Sentinel and willing to accept shallower passive discovery. Smaller teams with tighter budgets should evaluate Attaxion, IONIX, or Detectify based on asset count and whether web application exposure is the primary concern.
Why Your Internal Inventory Will Always Miss Something
Security teams treat the CMDB as ground truth because it is the only inventory they control. The problem is that external exposure is not defined by what you provisioned. It is defined by what resolves to your IP space, what announces your SSL certificates, what registers your brand name in a domain, and what cloud account was opened by a developer three acquisitions ago.
Consider a company that acquires two SaaS businesses over four years. Each acquisition brings its own DNS zones, cloud accounts, legacy staging environments, and CDN configurations. The acquiring company’s central IT team does an integration checklist, but the old AWS account with the staging environment from 2019 stays live because nobody owns the offboarding task. That account still has port 443 open, still has a certificate signed by the parent company’s intermediate CA, and is not in anyone’s CMDB. An attacker running passive certificate transparency enumeration finds it in minutes.
This is the core argument for external attack surface management tools: they do not replace internal inventory. They reveal the surface that internal inventory cannot see by design, because they start from the outside and work inward using the same signals an attacker would use.
How Do EASM Tools Actually Discover Assets Nobody Registered?
Attribution-based discovery is the mechanism that separates genuine EASM platforms from glorified port scanners. The process starts with seed data you provide, typically top-level domains, ASN ranges, or known IP blocks, and then the tool fans out using signals it collects without touching your environment.
The primary signals are certificate transparency logs, which expose every domain that has ever had a TLS certificate issued against it; passive DNS records, which capture historical resolution data; WHOIS and registration history, which link domains through registrant email addresses and organization names; and internet-wide scan data, which tools like Shodan and Censys’s own scan infrastructure collect continuously. A good EASM platform correlates these signals to build a graph of assets and then attributes each asset back to your organization, or flags it as a potential false positive for review.
The attribution step is where platforms diverge sharply. A tool that returns every IP block associated with your ASN is not doing attribution. A tool that finds a subsidiary’s forgotten domain by matching the SSL certificate’s organization field against a corporate entity graph, and then flags it with a confidence score, is doing attribution. That confidence score is the variable buyers should pressure-test hardest during evaluation.
The SecurityOpsWire Attribution Confidence Test
Because no comparison page on the SERP quantifies false-positive rates, we built a framework for evaluating attribution accuracy before you sign anything. Run what we call the EASM Attribution Confidence Test during your proof of concept.
Step one: seed the tool with your top three to five known domains and nothing else. Do not give it your full IP range or subsidiary list. Let the tool discover subsidiaries organically.
Step two: after the initial scan completes, pull the full asset list and manually validate a random sample of 50 attributed assets against your actual inventory. Count assets the tool correctly attributed, assets it correctly found that were missing from inventory, and assets it attributed to you that belong to another organization entirely.
Step three: calculate the false-attribution rate for that sample. Anything above 15 percent in a sample of 50 means the tool’s confidence scoring is not reliable enough to drive remediation workflows without heavy manual triage. Anything below 5 percent in the same sample is production-ready for most teams.
Step four: compare the newly discovered assets against your CMDB and cloud inventory. The count of real assets the tool found that you did not know about is the delta. That number is why you are buying the tool. If the delta is zero, either the tool’s discovery is shallow or your inventory is unusually complete. Either answer is worth knowing.
How Often Do These Tools Re-Scan, and Why Scan Frequency Matters More Than People Think
An internet-facing surface changes faster than most teams assume. Cloud deployments spin up and down in hours. Certificate issuance for new subdomains happens in minutes via Let’s Encrypt. A developer pushing a new microservice to production can create a new externally reachable endpoint before the next weekly scan cycle completes.
Scan frequency determines how quickly a new exposure appears in your workflow. Daily continuous monitoring is the practical minimum for a team that deploys frequently. Weekly scanning misses the exposure window for anything that spins up and gets patched or taken down between cycles. Some platforms offer near-real-time change detection by layering passive monitoring of certificate transparency logs and DNS changes on top of periodic active scans, which narrows the detection window without doubling scan infrastructure costs.
When evaluating a platform, ask specifically: what is the scan frequency for active probing, what is the latency for detecting a new certificate issued on a known domain, and does the rescan frequency differ between high-criticality assets and the broader asset inventory?
10 External Attack Surface Management Tools Compared
1. Palo Alto Networks Cortex Xpanse
Cortex Xpanse is one of the most mature platforms for large-enterprise internet asset discovery. Its scan infrastructure performs continuous active scanning of the full IPv4 space, which means it does not wait for your organization to seed it with IP ranges. It discovers assets by finding your fingerprints in the internet’s existing state.
Attribution in Xpanse relies on a proprietary entity graph that links organizations through certificate data, DNS records, BGP announcements, and WHOIS history. For enterprises with many subsidiaries, this is Xpanse’s strongest differentiator. It surfaces acquisitions and subsidiaries that were never added to internal inventory because it is matching organizational signals, not waiting for you to enumerate them.
The operational fit is clearly enterprise. Xpanse integrates directly into the Cortex XSOAR automation platform and into Cortex XSIAM for teams running Palo Alto’s broader SOC stack. Pricing is not publicly disclosed; Palo Alto quotes per environment. Scan frequency is continuous for its global internet scan, with attributed asset data refreshed daily.
2. Microsoft Defender External Attack Surface Management
Microsoft Defender EASM is the logical choice for organizations already running Microsoft Sentinel or Defender XDR, because the integration is native and the licensing terms make it easier to justify internally. The platform ingests your seed domains and uses Microsoft’s internet scanning infrastructure to discover associated assets.
Its discovery relies primarily on passive signals including certificate transparency, passive DNS, and WHOIS data, rather than active probing at the scale Xpanse performs. For most mid-market organizations with a contained asset footprint, this is sufficient. For enterprise environments with large legacy IP ranges and many subsidiaries, the shallower discovery becomes a limiting factor. Microsoft does not publicly publish pricing for Defender EASM as a standalone product; it is bundled into several Microsoft licensing tiers, and costs are negotiated per agreement.
The false-positive rate in practice depends heavily on how clean your seed data is. Organizations that seed it with a precise list of primary domains get cleaner attribution than those who seed with broad IP ranges.
3. CyCognito
CyCognito differentiates itself on the attribution side by building what it calls an organizational shadow graph: a constantly updated map of how assets connect to your organization through subsidiary relationships, certificate chains, and registrant metadata. This is the capability that makes it effective for post-acquisition environments where nobody has documented what the acquired company owned.
CyCognito performs active testing against discovered assets, not just enumeration. It validates exposures by attempting to confirm whether a vulnerability is actually exploitable from the outside, which reduces the alert volume that a security team has to triage. This active testing is both the platform’s strength and its operational risk: teams need to confirm CyCognito’s scan source IPs are excluded from WAF blocking rules and that legal approvals cover testing against subsidiary assets.
Pricing is not publicly listed. CyCognito quotes based on the organization’s asset footprint. The platform fits large enterprises and private equity portfolio companies with many subsidiaries better than it fits single-entity mid-market companies, where the organizational graph capabilities are underused.
4. Censys Attack Surface Management
Censys ASM is built on the same internet scan infrastructure that powers Censys’s research database, which covers the full IPv4 space and is updated continuously. This gives it an unusual advantage: the underlying data is the same data security researchers and threat intelligence teams use, which means attribution is anchored in high-fidelity scan telemetry rather than aggregated third-party feeds.
For teams that want to run their own queries against the raw internet scan data alongside the managed ASM product, Censys offers both. This dual-use model matters for organizations with dedicated threat intelligence functions that want to use the same dataset for adversary infrastructure tracking and for internal asset discovery. Censys does not publicly publish EASM product pricing; the research API has public pricing tiers listed on the Censys pricing page.
Scan frequency is continuous at the infrastructure level, with attributed asset inventories refreshed on a schedule that varies by plan. The platform is a good fit for security engineering teams that want API access to the underlying data and the ability to build custom discovery workflows.
5. Bitsight
Bitsight started as a security ratings company and has expanded into EASM through its Attack Surface Analytics product. Its primary differentiation from pure-play EASM tools is the integration of vendor risk and supply chain exposure data alongside your own organization’s surface.
For security leaders who are managing both their own external exposure and third-party risk for a vendor portfolio, Bitsight’s consolidated view has real operational value. For teams that only need to discover and monitor their own assets, the additional supply chain data is overhead. Discovery relies on Bitsight’s scan infrastructure and passive data collection. Pricing is not publicly disclosed.
Bitsight fits organizations where the CISO owns both the internal attack surface program and the third-party risk management function, because the workflow consolidation is where the ROI appears.
6. Detectify
Detectify is a surface monitoring platform built around web application exposure rather than network-layer asset discovery. Its discovery engine finds subdomains and web assets, and then its scanning module tests those assets for application-layer vulnerabilities using a signature database built and maintained by its security researcher community.
This community-sourced vulnerability coverage is Detectify’s strongest differentiator for teams focused on web application exposure. It surfaces misconfigurations and vulnerabilities in web applications faster than platforms that rely solely on commercial vulnerability databases. The tradeoff is that it is not built for network-layer discovery or for finding non-web assets like exposed databases or legacy industrial services. Detectify’s website presents a “Book a demo” and “Start a trial” path rather than published pricing; specific per-domain rates or tier structures are not disclosed on the Detectify site. It fits application security teams and SaaS companies more naturally than it fits infrastructure-heavy enterprises.
7. runZero
runZero is a network discovery and asset inventory platform that covers both internal and external assets. Its external attack surface discovery uses active scanning from external vantage points combined with passive fingerprinting techniques. The platform was built to solve the OT/IoT asset discovery problem as much as the traditional external surface problem, which makes it distinctive in environments where the internet-facing perimeter includes industrial or legacy devices.
runZero’s pricing model is structured around asset count; no source page was provided to verify published tier rates, so buyers should confirm current pricing directly with the vendor before modeling costs. For teams that need a single platform to map internal network assets, OT/IoT devices, and external exposure, runZero covers the broadest technical scope of any platform in this list. For pure external attack surface discovery at enterprise scale, Xpanse or CyCognito have deeper attribution capabilities.
8. Rapid7 Surface Command
Rapid7 Surface Command is the external attack surface management product in Rapid7’s exposure management portfolio. It aggregates data from Rapid7’s own scanning infrastructure alongside third-party sources to build an asset inventory, and it connects to InsightVM for vulnerability correlation across discovered assets.
The practical value of Surface Command for existing Rapid7 customers is the unified workflow: discovered external assets flow into the same remediation tracking and vulnerability prioritization pipeline that their internal scanning already uses. For teams not already running InsightVM or InsightIDR, the integration story is less compelling and the standalone discovery capability is competitive but not leading-edge relative to Xpanse or CyCognito.
Pricing is not publicly listed. Rapid7 quotes based on environment and product bundle. If you are already running Rapid7 for vulnerability management, Surface Command is worth evaluating before adding a second vendor.
9. Tenable Attack Surface Management
Tenable ASM (formerly Tenable.asm, built on the Bit Discovery acquisition) integrates with Tenable One for organizations running Tenable’s vulnerability management platform. The discovery engine maps internet-facing assets through domain enumeration, certificate transparency, and passive DNS, and it feeds discovered assets into Tenable’s broader exposure management workflow.
The integration depth with Tenable Nessus and Tenable One is the primary reason to choose it over a standalone EASM tool. External assets discovered by the ASM module can immediately be scheduled for authenticated scanning, which closes the loop between “we found this asset” and “we have a vulnerability scan for this asset.” For organizations running Tenable as their primary scanner, this workflow is significantly more efficient than maintaining a separate EASM tool and manually exporting asset lists. Pricing is not publicly disclosed; Tenable structures quotes based on asset count and product bundle.
10. Attaxion and IONIX
Attaxion and IONIX are newer entrants that have positioned themselves as mid-market alternatives to the enterprise-tier platforms. Both offer attribution-based discovery with dashboards built around exposure severity rather than raw asset count. IONIX places particular emphasis on digital supply chain exposure, surfacing risks in third-party scripts, CDN configurations, and external dependencies alongside directly owned assets.
For security programs at mid-market companies that do not have the budget or the operational capacity to run an enterprise EASM platform, both are worth evaluating. Attaxion does not publicly list pricing. IONIX does not publicly list pricing. Both offer trial access. The attribution depth for complex multi-subsidiary environments has not been publicly benchmarked against Xpanse or CyCognito, which is a gap
buyers should test directly during evaluation.
Feature and Fit Comparison
| Platform | Primary Discovery Method | Scan Frequency | Best Fit | Pricing Model |
|---|---|---|---|---|
| Cortex Xpanse | Active global IPv4 scan + entity graph | Continuous | Large enterprise, multi-subsidiary | Not publicly disclosed |
| Microsoft Defender EASM | Passive CT logs, DNS, WHOIS | Daily | Microsoft Sentinel shops | Bundled in Microsoft tiers |
| CyCognito | Active testing + org shadow graph | Continuous | Enterprise with many subsidiaries | Not publicly disclosed |
| Censys ASM | Continuous global scan + passive | Continuous | Engineering-forward teams, threat intel | Not publicly disclosed for ASM |
| Bitsight | Passive scan + ratings data | Continuous | CISO owning TPRM + EASM | Not publicly disclosed |
| Detectify | Subdomain discovery + web app scanning | Continuous for web | SaaS companies, AppSec-led teams | Not publicly disclosed |
| runZero | Active scan internal + external | Scheduled | OT/IoT + traditional surface | Verify directly with vendor |
| Rapid7 Surface Command | Proprietary scan + third-party data | Continuous | Existing Rapid7 customers | Not publicly disclosed |
| Tenable ASM | CT logs, passive DNS, domain enum | Continuous | Existing Tenable One customers | Not publicly disclosed |
| Attaxion / IONIX | Attribution graph + passive signals | Continuous | Mid-market, digital supply chain focus | Not publicly disclosed |
What Does EASM Pricing Actually Look Like at Scale?
Almost no EASM vendor publishes list pricing. This is not unusual for enterprise security software, but it creates a problem for buyers trying to build a business case before they enter a sales cycle. The pricing model, which is publicly inferable even when the rates are not, tells you more than you might expect.
Platforms that price per seed domain reward organizations with a small number of top-level domains but many subdomains. Platforms that price per discovered asset penalize organizations with large, complex surfaces and create a perverse incentive to reduce inventory scope to control costs. Platforms that use flat subscription pricing favor large enterprises with mature programs because the per-asset cost falls as the surface grows.
Consider a hypothetical mid-market company with five known top-level domains, 200 discovered subdomains, and four subsidiaries with their own domain footprints. Under per-domain pricing at typical enterprise rates, that same organization might pay materially differently from a single-entity company with 50 top-level domains and no subsidiaries. The right pricing model depends entirely on your surface shape, not your company size. Force vendors to quote you against your actual asset count and your likely discovered asset count, not a theoretical average.
No platform in this list has verified publicly published per-asset tier pricing available in the source material reviewed for this article. For every platform, the answer is to run a proof of concept, get the asset count the tool discovers, and use that number to anchor the pricing negotiation.
EASM vs CTEM: What Is the Actual Difference?
EASM is a discovery and monitoring function: it finds your internet-facing assets, attributes them to your organization, and tracks changes to exposure over time. Continuous threat exposure management (CTEM) is a Gartner-coined program framework that encompasses discovery, scoping, prioritization, validation, and mobilization across all attack surface types, not just external. EASM feeds the discovery phase of a CTEM program. It is not a CTEM program by itself.
Several vendors in this list, including Tenable and Rapid7, market their combined products as CTEM platforms because they cover vulnerability management and external discovery in one workflow. That claim is reasonable when the integration is tight and the prioritization logic crosses internal and external data. It is less reasonable when the two products are loosely coupled through an API with no shared remediation tracking. If you are building a CTEM program, our comparison of the best CTEM platforms covers the broader exposure management workflow that EASM feeds into.
The practical implication: if your security program currently has no formal exposure management process, EASM is not a CTEM program and buying one will not give you one. Buy EASM to answer “what is exposed and where.” Build or buy CTEM to answer “what do we fix first and how do we track it.”
How to Run a Discovery Pass and Size Your Unknown Surface
The behavioral goal of any initial EASM deployment is to produce a reconciled number: assets the tool found that your internal inventory does not contain. That number is the business case, the board slide, and the prioritization input all at once. Here is how to produce it cleanly.
Start with your definitive internal asset list. Pull every internet-facing asset from your CMDB, your cloud provider inventories (AWS Resource Explorer, Azure Resource Graph, GCP Asset Inventory), and your DNS zones. Export this as a flat list of hostnames and IP addresses. This is your baseline.
Run the EASM tool with minimal seeding. Give it your top-level domains and your primary ASN. Resist the temptation to give it your full IP list, because doing so teaches it your inventory rather than letting it discover independently.
After the first scan cycle completes, export the full attributed asset list. Match it against your baseline using a simple join on hostname and IP. Assets in the EASM output that are not in your baseline are your unknown surface. Assets in your baseline that are not in the EASM output either were not scanned (check coverage) or are incorrectly classified as internet-facing in your inventory.
Categorize the unknowns: forgotten subdomains, subsidiary assets, shadow cloud accounts, third-party hosted services attributed to your org. Each category has a different remediation owner and a different risk profile. A forgotten subdomain pointing to a decommissioned server is a different risk than a live staging environment running an outdated application framework.
For teams building this kind of structured asset inventory function from scratch, the discovery workflow overlaps with non-human identity and service account enumeration, particularly for cloud environments where machine identities attach to resources that may not be inventoried. The best non-human identity discovery tools cover the identity-side of that same cloud asset gap.
What Should You Actually Prioritize in the Initial Discovery Output?
The first EASM scan for most organizations returns hundreds to thousands of assets. Without a triage framework, the list is unmanageable. Prioritize in this order.
First, assets running services that have no business justification for being internet-facing: databases, admin panels, development servers, internal tools. These are the highest-risk findings because they represent genuine mistakes, not intentional exposure.
Second, assets running outdated software versions with known exploits. Your EASM tool may surface version banners; cross-reference against the CISA Known Exploited Vulnerabilities catalog to find the ones with confirmed in-the-wild exploitation.
Third, assets you do not recognize at all and cannot quickly attribute to a team. These are the shadow IT and acquisition-era orphans. Get them into a triage queue immediately; ownership resolution takes time and the asset sits exposed while you find the owner.
Exposure management programs that run EASM well are also investing in vulnerability prioritization beyond raw CVSS scores, because a high-severity vulnerability on an asset nobody manages is categorically different from the same CVE on a hardened production server with compensating controls. The connection between external asset discovery and structured exposure management platforms is where the program matures beyond a one-time audit into a continuous control.
Frequently Asked Questions
What is external attack surface management?
External attack surface management is the continuous process of discovering, attributing, and monitoring every internet-facing asset associated with an organization, including assets the organization may not know it owns. It uses signals like certificate transparency logs, passive DNS, WHOIS history, and active internet scanning to find assets from the outside in, the same way an attacker would approach reconnaissance. The goal is to produce an accurate, continuously updated inventory of external exposure.
How do EASM tools find assets that nobody registered?
Attribution-based discovery correlates passive signals, certificate organization fields, registrant email addresses, DNS historical records, BGP announcements, and SSL certificate chains to build a graph of assets connected to your organization. Many discovered assets were registered by subsidiaries, acquired companies, or individual developers using corporate email addresses, and the tool attributes them by following those organizational signals rather than waiting for central IT to enumerate them.
What is a realistic false-positive rate for EASM attribution?
Published benchmarks do not exist for this metric, which is a gap in the market. In practice, false-attribution rates vary significantly by tool and by how complex the organization’s corporate structure is. During a proof of concept, manually validate a sample of 50 attributed assets. A false-attribution rate below 5 percent in that sample indicates the platform is ready for production workflows. Above 15 percent means the attribution confidence scoring needs heavy calibration before remediation teams should act on it.
How often should an EASM tool re-scan the external surface?
Daily is the practical minimum for organizations with active cloud deployments. New subdomains can appear within minutes via automated certificate issuance, and new cloud resources can become internet-facing without human review. The best platforms layer continuous passive monitoring of certificate transparency and DNS change feeds on top of periodic active scanning, which narrows the detection window for new exposures without requiring a full active scan on every cycle.
What is the difference between EASM and CTEM?
EASM is a discovery function: it finds and monitors internet-facing assets. CTEM (continuous threat exposure management) is a program framework, coined by Gartner, that covers discovery, scoping, prioritization, validation, and remediation tracking across all exposure types. EASM is an input to the discovery phase of a CTEM program. Several vendors market combined vulnerability management and EASM products as CTEM platforms, which is reasonable when the integration is tight but misleading when the two products share only an API.
Does EASM replace internal network scanning?
No. EASM discovers external exposure starting from the outside. Internal network scanning discovers vulnerabilities in assets you already control and can authenticate against. The two functions are complementary: EASM finds what exists and what is reachable; internal scanning tells you what vulnerabilities exist on those assets. The gap EASM fills is the inventory problem, not the vulnerability scanning problem.
What per-domain or per-asset pricing looks like for enterprise buyers
Almost all enterprise EASM vendors quote per environment rather than publishing list pricing. The pricing model (per seed domain, per discovered asset, per subsidiary, or flat subscription) determines cost more than the headline rate, because the same dollar amount produces very different costs depending on surface shape. No vendor in this list has verified published per-asset tier pricing in the source material reviewed for this article. For every platform, request a quote anchored to your actual discovered asset count from the proof of concept, not a vendor-estimated average.
How does shadow IT discovery differ from EASM?
Shadow IT discovery traditionally identifies unauthorized SaaS applications employees are using, typically through DNS query analysis or web proxy logs. EASM finds unauthorized or untracked internet-facing infrastructure: cloud accounts, domains, servers, and services that belong to the organization but are not in central inventory. The two are related but distinct problems. An EASM tool that finds a shadow cloud account is performing shadow IT discovery at the infrastructure layer. A SaaS discovery tool that inventories unauthorized Slack workspaces is not performing EASM. Some platforms are beginning to bridge these, but they remain separate product categories with different data sources.
Which Tool Fits Which Program
The right external attack surface management tool is not the one with the longest feature list. It is the one whose attribution model fits your organizational complexity and whose operational overhead fits your team size. Palo Alto Cortex Xpanse is the right answer for an enterprise running 20 subsidiaries across four continents and a SOC team large enough to operationalize continuous alerts. Microsoft Defender EASM is the right answer for a 500-person company already paying for Microsoft E5 licensing that needs good-enough discovery without a separate vendor relationship.
For teams building their first structured EASM program, the discovery pass described above is the place to start, not the platform selection. Run a trial with two or three tools against the same seed data and compare the delta each one produces against your known inventory. The tool that finds the most real unknowns with the fewest false attributions is the right tool for your surface. No feature matrix will tell you that. Only the proof of concept will.
The security teams that get the most value from EASM are the ones that treat the initial discovery output as a program input, not a report. They reconcile it against their CMDB, assign ownership for every unknown, and track remediation the same way they track vulnerabilities from internal scans. If your program is not set up to act on what EASM finds, the tool produces a list that ages into irrelevance. The discovery is only the beginning. For teams building the broader exposure management workflow that EASM feeds into, the connection to structured exposure management programs is where the program sustains itself past the first audit cycle.
