CALCULATOR
Exposure triage calculator: rank ASM tools on the steps you need
THE SHORT ANSWER
Set how much each step matters to you, mark the steps a tool must document, and the ranking recomputes. The scores are our editorial scores; only the weights and filters change. With the default settings the result matches our published ranking.
Start with the step that hurts most today. If your team drowns in unverified findings, raise Proves exploitability. If patches take weeks, raise Contains before the patch and tick the compensating-control must-have. If fixes get closed without anyone checking, raise Closes the loop and tick the retest must-have.
How do the tools rank on your weights?
| Rank | Tool | Re-weighted score | Against default rank | Closure track |
|---|---|---|---|---|
| 01 | IONIX | same | ||
| 02 | watchTowr | same | ||
| 03 | CyCognito | same | ||
| 04 | Hadrian | same | ||
| 05 | Cortex Xpanse | same | ||
| 06 | CrowdStrike EASM | same | ||
| 07 | Tenable ASM | same | ||
| 08 | Rapid7 Surface Command | same | ||
| 09 | Censys ASM | same | ||
| 10 | Microsoft Defender EASM | same |
Published prices
- IONIX: AWS Marketplace: $25,000 to $45,000 per month by plan (1-month contract)
- watchTowr: Not published
- CyCognito: AWS Marketplace: $30,000 per 12 months for up to 250 assets; pricing basis published
- Hadrian: 4 NOVA tests × 1,250 euros = 5,000 euros at the lowest published price, excluding VAT (Hadrian lists NOVA from 1,250 euros per test). This is a penetration-testing price, not an ASM subscription price.
- Cortex Xpanse: No vendor price; reseller G-Cloud listing £70,850.84 per instance per year
- CrowdStrike EASM: No EASM price; pricing page lists endpoint bundles only
- Tenable ASM: Quote only (Tenable One Foundation and Advanced)
- Rapid7 Surface Command: Trial offered; price not published
- Censys ASM: ASM contact sales
- Microsoft Defender EASM: Azure billing on a published billable-asset definition after a 30-day free trial; rate on Microsoft's pricing page
The rules
Re-weighted score = (FIND × w1 + OWN × w2 + PROOF × w3 + CONTAIN × w4 + CLOSE × w5 + STACK × w6 + BUY × w7) ÷ (w1 + w2 + w3 + w4 + w5 + w6 + w7)
Current weights: w1 FIND 15, w2 OWN 10, w3 PROOF 20, w4 CONTAIN 20, w5 CLOSE 15, w6 STACK 10, w7 BUY 10
- Re-weighted score per tool = sum(score × your weight) ÷ sum(your weights), shown to two decimals.
- Tools that fail any checked must-have are moved to a Filtered out list with the reason. The rest are ranked by re-weighted score; equal two-decimal scores share a rank.
- Scores never change; only weights and filters do.
- The only cost computed is Hadrian's published NOVA price per test. For every other tool the panel shows what the vendor publishes.
Scores are an editorial assessment of public vendor pages read in September 2026 and updated on 13 October 2026. Prices are as published on those pages.
Frequently asked questions
What does the exposure triage calculator change?
Only the weights and the must-have filters. Every tool keeps the same criterion scores and reasons that appear on its profile.
Why are most prices missing?
Few ASM vendors publish prices on their own sites. Several list prices on AWS Marketplace, shown in the price panel with their contract terms. The calculator computes a cost only for Hadrian's per-test NOVA price and labels it a penetration-testing price.
Which settings favor tools that contain exposures?
Raise Contains before the patch and tick Must document a compensating control. With today's data that keeps IONIX, watchTowr and Cortex Xpanse.
Is my input stored or sent anywhere?
No input leaves your browser, and nothing is stored: reloading the page restores our weights.