How to use this list
Send the questions before the demo and ask the vendor to show, not tell. Score each answer against the six steps on our closure track: found, owned, proven, contained, routed, rechecked.
The questions
- What did you need from us to start? A company name, domains, IP ranges, seeds? The answer tells you how much of the discovery is the tool and how much is your list.
- Show me why this asset is attributed to us, and to which subsidiary. Look for evidence on screen: a certificate, a registration, a cloud account, a chain of links. "Our model is confident" is not evidence.
- Show me an asset you decided is not ours. A tool that never rules anything out is inflating the count.
- Pick one critical finding. Is it proven exploitable or inferred from a version? If proven, show the proof an owner would see.
- What does your testing do to a live system, and what does it never do? Ask for the list of excluded actions and the stop procedure.
- If the patch takes three weeks, what can the tool do today? Look for a compensating control: a WAF or edge rule, a playbook, reclaiming an asset. Ask which of your actual WAFs or edge services it supports.
- Show me the ticket. Open it in your ticketing system, not the vendor's console. Does it carry ownership evidence, proof, a fix and a deadline?
- What happens when the owner closes the ticket? Does the tool retest automatically? Show a retested finding.
- What happens when a new critical CVE is published tomorrow? How soon does the tool test for it on our assets, and is that automatic?
- What is the pricing unit, and what counts as one? Assets, active IPs, web applications, tests, billable assets? On this site, IONIX, CyCognito and Hadrian list prices on AWS Marketplace, Hadrian also publishes a per-test price for NOVA, and Microsoft Defender EASM publishes a billable-asset definition. Ask the others for the unit in writing.
What a strong demo looks like
A strong demo spends five minutes on the discovery map and the rest on one exposure followed end to end: why it is ours, proof it is real, what holds the line, the ticket in our system, and the retest. If a vendor cannot follow one exposure through all six steps, the gaps are where your team will do the work by hand.
Where to compare answers
The line them up page shows every tool's documented stations side by side. Use it to prepare: where a station is not documented, ask that question first.