Why do most ASM proofs of concept mislead?
Because they measure the easiest thing. Each vendor runs discovery, each returns a number, and the biggest number wins the meeting. As lesson 3 explains, counts are not comparable and a bigger inventory is not a better outcome.
Step 1: fix the inputs
Give every tool the same starting point, and record what each needed. Inputs differ by design: CyCognito states its discovery starts from the organization's name alone; Censys expands from seeds the customer adds; Microsoft Defender EASM offers a prebuilt inventory or seeds. If one tool gets your full domain list and another gets only a name, you are testing your list, not the tool.
Step 2: fix the time
Run all tools over the same period, ideally two to four weeks, so continuous testing has time to work. Agree the testing rules from lesson 4 with each vendor before day one.
Step 3: prepare known answers
Before the trial, write down a small set of things you already know: a few assets in subsidiaries, one asset that belongs to a supplier, one known exploitable exposure in a test environment you control and are allowed to expose, and one asset that looks like yours but is not. These answer questions a count never can: did the tool attribute correctly, did it prove the known weakness, did it avoid the decoy?
Step 4: score by step
Use the six steps from lesson 1 as the scorecard.
- Found: did it find the known subsidiary and supplier assets?
- Owned: did it attribute them correctly, with evidence? Did it rule out the decoy?
- Proven: did it prove the known exposure, and with what evidence?
- Contained: could it propose or push a compensating control into your actual WAF or edge service?
- Routed: did the ticket in your system carry ownership, proof and a fix?
- Rechecked: after you fixed the known exposure, did it retest and confirm?
Step 5: price the same unit
Ask every vendor for a quote in the same unit for the same estate. Published figures on this site include AWS Marketplace prices for IONIX (monthly plans by monitoring frequency), CyCognito (up to 250 assets per 12 months) and Hadrian ATLAS (250 assets per 12 months), Hadrian's per-test NOVA price, billable assets on Azure for Microsoft Defender EASM, and a UK reseller listing for Cortex Xpanse. Rapid7 offers a trial. Convert each to the same unit, and ask what one unit covers.
Step 6: weigh the result
Weight the steps by what hurts most in your program and compare. The exposure triage calculator does this with our editorial scores; your proof-of-concept scorecard does it with your own evidence, which is better.