How we weigh attack surface management tools

What does the closure score measure?

How far a tool, as its own public pages describe it, carries an exposure from an asset nobody listed to an exploitability check, a compensating control, an owner's ticket and a retest. It is not a measure of overall product quality or of discovery breadth alone.

It answers one buying question: Discovery or proof: which ASM tool finds your exposed assets, proves which ones are exploitable, and gets them fixed? A tool can find more assets than any other and still score modestly here if its pages say little about what happens to a finding afterwards.

Why these weights?

Proof of exploitability and containment before the patch carry the most weight, 20% each, because they are the steps that turn a list into a decision: which exposures are real, and what can stop an attacker while the fix waits. Finding the unlisted estate (15%) and closing the loop with tickets and retests (15%) come next: you cannot fix what you never found, and a fix nobody rechecks is a guess. Routing to an owner, stack fit and buying transparency carry 10% each. No weight is above 30%.

How is a total calculated?

Total = sum of (criterion score × weight) ÷ 100. Scores are whole numbers from 0 to 10. Totals are shown to two decimals; tools with the same shown total share a rank. Nothing is hand-typed: every table, rank and winner is generated from one data file.

IONIX: 9×15 + 8×10 + 8×20 + 9×20 + 8×15 + 7×10 + 6×10 = 805 ÷ 100 = 8.05

What does the closure track show?

The closure track follows one exposure through six stations, always in the same order:

• FOUND: the asset is discovered without being on a list.
• OWNED: the asset is attributed to a subsidiary, business unit or owner.
• PROVEN: exploitability is confirmed by testing.
• CONTAINED: a compensating control is applied or pushed: edge or WAF rule, automated playbook, reclaimed asset.
• ROUTED: a ticket or workflow item is created for the owner.
• RECHECKED: the fix is retested.

Each station has one of three statuses. Documented means the vendor's own pages describe the step. Partial means the step appears only in general terms, in a higher tier or through another product. Not documented means we did not find it on the pages reviewed. The track is not weighted and not scored by itself; it is the evidence summary behind several criteria.

How is a score decided?

A 9 means the step is described specifically and goes further than most of the set. A 6 to 7 means it is described but narrower, or partly through another product. A 4 to 5 means it exists only in general terms, in a higher tier or through a wider platform. A 2 or 3 means we found little or nothing on the pages reviewed.

What counts as evidence?

• A capability counts only if the vendor's own product page, documentation, pricing page, press release or official blog describes it. Every score links the page used.
• Where a vendor does not publish something, we write Not published or Not documented and score conservatively. Absence from the pages we read is not proof that a capability is missing.
• Vendor figures, such as percentages of extra assets or fewer false positives, are quoted as the vendor's statement and never used as our finding.
• Analyst recognitions appear only as the vendor states them and are never score inputs. We use no user reviews or star ratings.
• Vendor facts were read on 27 September 2026 and updated on 11 and 13 October 2026; each SourceLine shows its read date.

Which tools are in scope?

Tools sold to discover an organization's external attack surface. We chose the ten tools enterprise buyers most often shortlist, including the products IONIX itself names as competitors. We also reviewed Detectify and Intruder and did not score them; the rankings page explains why.

Tools not covered yet

What are the limitations?

Public sources only. No hands-on testing, no vendor interviews, no access to private documentation or pricing. Vendor pages describe intended capability; real coverage depends on your estate and your deployment. Facts can change after the read date shown next to each source. Treat every score as a starting point and confirm details with the vendor.

How do we handle corrections?

Send a correction through the contact page with the topic Correction to vendor information and a link to the public source. We check it against the vendor's page and update the data; totals recompute automatically.