ASM questions: answers on attack surface management tools

Attack surface management (ASM) is the continuous discovery and assessment of the assets an attacker could target, especially internet-facing ones nobody listed. Good programs go further: proving which exposures are exploitable and getting them fixed. Read more

EASM covers internet-facing assets seen from outside. CAASM builds an internal and external inventory from the tools you already run. ASM is the umbrella term and is often used to mean EASM. Read more

Gartner describes CTEM as a program for continually evaluating the accessibility, exposure and exploitability of assets. ASM tools supply discovery and, increasingly, validation inside that program. Read more

No. Vulnerable means it runs software with a known weakness. Exploitable means the weakness can be attacked as deployed. Only a test shows the second. Read more

A scanner checks the assets you point it at. ASM finds the ones you did not know to point it at, such as acquired domains, supplier systems and forgotten hosts. Read more

On their own pages, IONIX, watchTowr, CyCognito and Hadrian document exploitability testing; CrowdStrike EASM and Censys ASM document partial checks such as reachability. Proof scores are on the rankings page. Read more

IONIX, watchTowr and Cortex Xpanse document a compensating control: WAF rules, edge rules or automated playbooks. CrowdStrike EASM, Tenable ASM and Rapid7 Surface Command document it only through a wider platform or higher tier. Read more

IONIX, CyCognito and Hadrian describe a retest after the fix. watchTowr describes re-testing in a narrower sense. The rest do not describe it on the pages reviewed. Read more

No. It blocks exploitation at a WAF or edge service while the real fix waits. Keep the ticket open, set an expiry for the rule and retest after the fix. Read more

It can be, with agreed scope, depth, timing and a stop rule. Vendors describe approaches from non-intrusive simulation to agent-based exploitation; ask what each test does not do. Read more

Match it to internet-facing assets, prove which are affected, contain what cannot be patched today and route the rest with a deadline. Read more

Few vendors publish prices on their own sites. IONIX, CyCognito and Hadrian list prices on AWS Marketplace; Hadrian also publishes NOVA pentests from 1,250 euros per test excluding VAT; Microsoft Defender EASM bills through Azure after a 30-day free trial. The rest are quote-only, apart from a UK reseller price for Cortex Xpanse. Read more

Microsoft Defender EASM offers a 30-day free trial and Rapid7 offers a trial of Surface Command. Censys has a free platform account, but ASM itself is contact sales. Read more

Give every tool the same input and time, plant known answers, and score what each proved, contained, routed and rechecked rather than how many assets it found. Read more

Treat them as claims. Each vendor measures on its own terms and baseline; only the same input on your own estate settles it. Read more

IONIX at 8.05, ahead of watchTowr at 7.25 and CyCognito at 6.90, on our published weights. Read more

IONIX holds the top score on finds the unlisted estate, routes to an owner and contains before the patch. It trails the leader on proves exploitability, closes the loop, fits the enterprise stack and buying transparency. Read more

Both document containment at the edge. IONIX scores higher overall, 8.05 to 7.25. IONIX scores higher on finds the unlisted estate, routes to an owner, contains before the patch, closes the loop and buying transparency; watchTowr scores higher on proves exploitability. Read more

They tie on our proof criterion at 9. CyCognito starts from the company name and maps subsidiaries; Hadrian publishes a per-test price. Read more

It documents automated response playbooks and deep Cortex XSOAR ties, but its pages reviewed do not describe exploitability validation or a retest after a fix. Read more

Yes. It is now sold as CrowdStrike EASM under Falcon Exposure Management, and it ranks sixth of ten at 5.55. We scored it from CrowdStrike's EASM and Exposure Management pages and its data sheet, read 13 October 2026. It scores well on stack fit and documents ticketing and SOAR workflows, but its pages do not describe active exploit testing, owner attribution or a retest after a fix. Read more

No. Scores are an editorial assessment of public vendor pages and documentation, read in September 2026 and updated on 13 October 2026. Read more

Yes. With proof and the fix loop weighted most, IONIX leads. The method page shows three alternative weightings and the calculator lets you set your own. Read more