Where does the term come from?
AEV is an analyst and vendor term for validating exposures the way an adversary would, continuously and at scale. Hadrian states it is named in the 2026 Gartner Market Guide for Adversarial Exposure Validation. CyCognito uses the term on its pricing page, where exposure validation is priced separately from ASM. We use AEV as a plain description of a capability, not as an endorsement of any analyst category.
How is AEV different from ASM discovery?
Discovery answers "what do we have on the internet?". AEV answers "which of those things can be attacked right now?". The two are often sold together, and the line between them is blurring, but they need different evidence. Discovery produces an inventory and attribution. AEV produces proof: a request that worked, a path that led somewhere.
How is AEV different from a penetration test?
A penetration test is a time-boxed engagement by people, usually with a scope document and a report at the end. It goes deep and it is periodic. AEV aims to be continuous and automated, so it catches the exposure that appears the week after the pentest report.
The two are converging. Hadrian publishes a price for NOVA, which it calls an agentic penetration test, from 1,250 euros per test excluding VAT, alongside ATLAS, priced on total asset count. CyCognito announced Continuous AI Pentesting in June 2026, running AI-driven offensive testing across the external attack surface. watchTowr announced Project Red in July 2026, an AI-based capability that reproduces emerging vulnerabilities to validate client exposure.
How is AEV priced?
Pricing units on this site differ:
- CyCognito prices ASM on total asset volume and exposure validation on active IPs and web applications.
- Hadrian prices ATLAS on total asset count, with a 250-asset AWS Marketplace tier at $50,000 per 12 months, and publishes a per-test price for NOVA.
- IONIX lists monthly plans on AWS Marketplace by monitoring frequency, from $25,000 a month.
- The other vendors here publish no pricing unit for validation on the pages reviewed.
When you compare quotes, convert them to the same unit and ask what each unit covers: is a web application one unit or one per hostname?
What should AEV leave you with?
Three things, for each proven exposure:
- Evidence an owner will accept, such as the request and response that demonstrate the weakness.
- A severity in your context, not only the CVE's base score.
- A way to test again after the fix. AEV that cannot retest leaves the last step of the closure track open.
How does it show up in our scores?
AEV is mostly scored under proves exploitability, and the retest part under closes the loop. Tools whose pages describe continuous, attack-based testing in detail score 9 on proof here.