Attack surface management tools fall into three tiers: enterprise EASM platforms that discover and monitor thousands of assets across subsidiaries, mid-market scanners that watch a target list you give them, and free or open-source tools that a small team can run itself. Pick by how many assets you have and who will act on the alerts — not by check count.
How do you choose an attack surface management tool?
Five questions decide it; everything else is a demo.
- Asset discovery or target list? True EASM finds assets you didn't tell it about (from seeds like a domain or company name). Scanners test the list you supply. If you have under ~50 hostnames and can produce the list yourself from CT logs and DNS, discovery is the feature you're paying most for and using least.
- Passive or active? Passive reads public configuration (headers, TLS, DNS, CT logs, RDAP) and is safe to run against anything you own. Active sends payloads and needs explicit authorisation — and a target you're allowed to test. Agencies scanning client sites should default to passive unless the client has signed for more.
- Who reads the output? Developer-facing tools produce findings with CVE IDs and CVSS scores; owner-facing tools explain the business impact and the fix. If the person receiving the report isn't an engineer, the second kind gets acted on.
- Pricing model. Per asset, per target, per user or flat. Per-asset pricing punishes discovery (the better the tool finds things, the more you pay); flat or per-organisation pricing suits agencies with many small clients.
- Monitoring of things that aren't yours. Lookalike domains, cloned sites and impersonation certificates sit outside your inventory and outside most scanners' scope. If phishing against your customers is a risk, check this box explicitly — see attack surface monitoring.
Attack surface management tools compared
Facts below are from each vendor's public documentation at the time of writing; pricing models are described, not quoted, because most change by negotiation. MySecScan is listed on the same terms as everyone else — it is a free-checker-plus-monitor product, not an enterprise EASM platform.
| Tool | Best for | Discovery | Monitoring | Pricing model | Free tier |
|---|---|---|---|---|---|
| MySecScan | Small teams, agencies, site owners | Passive checkers per host; CT-log subdomain count | Domain Monitor: clones, lookalike certs, typosquats (verified domains) | Free checkers + free monitor beta; operator-run full scan | Yes — no signup |
| Microsoft Defender EASM | Enterprises on Azure | Seeded crawl of the org's internet footprint | Continuous inventory + Defender integration | Per discovered asset, billed through Azure | Trial |
| CyCognito | Large enterprises | Graph-based discovery across subsidiaries | Continuous, with active testing | Quote-based | No |
| Detectify | Product/security teams | Subdomain discovery + crowdsourced payload tests | Continuous surface + app scanning | Per-domain/asset subscription | Trial |
| Intruder | SMB to mid-market with IT staff | Cloud-connector + target list | Scheduled vulnerability scanning, emerging-threat scans | Per target, published tiers | Trial |
| Censys / Shodan | Researchers, security teams | Internet-wide scan data you query | Saved searches / alerts on paid tiers | Freemium, per-query and subscription | Limited |
| HostedScan | IT generalists, small businesses | You supply targets; wraps OpenVAS, nuclei, ZAP, nmap | Scheduled scans, change alerts | Per target, published tiers | Limited free tier |
| subfinder + nuclei + testssl.sh (OSS) | Anyone comfortable with a terminal | Passive + active subdomain enumeration | Whatever you script (cron + diff) | Free (your time) | Yes |
Enterprise EASM — Defender EASM, CyCognito, and peers (Palo Alto Cortex Xpanse, IONIX, Hadrian)
Built for organisations that genuinely don't know what they own: acquisitions, dozens of business units, cloud accounts nobody inventoried. Discovery from a seed, continuous re-discovery, risk scoring, ticketing integrations. The value is real above a few hundred assets; below that you are paying for a search engine to find ten things you could have listed.
Mid-market scanners — Intruder, Detectify, HostedScan
You give them targets, they scan on a schedule and alert on new findings; Detectify adds subdomain discovery and crowdsourced payloads, Intruder adds cloud connectors and emerging-threat scans, HostedScan wraps well-known open-source engines behind a simple UI. Good fit for an SMB with one person who owns IT. Output is developer-facing; someone has to translate it for the business.
Internet-wide scan data — Censys, Shodan
Not scanners of your surface but databases of everyone's. Search your own IPs and domains to see what an attacker already knows; set alerts on paid tiers. Excellent for “what ports are open on things that resolve to us” without ever running a port scan.
Free and open-source — the stack a small team actually runs
subfinder or amass for subdomains, httpx to see which are live, nuclei for templated checks, testssl.sh for TLS, dnstwist for lookalike domains, plus passive web checkers for headers, cookies, CSP and email. Combined with a cron job and a diff, it's a complete program; the cost is someone's time and the discipline to only scan what you own.
For the site owner and for the developer
For the site owner (plain English)
If you run one company website and a handful of subdomains, you do not need an enterprise attack surface platform. You need: a list of what you own, free checks that tell you what's weak in plain English, and an alert when someone registers a lookalike of your domain or copies your site. Buy a platform when you have more assets than one person can hold in their head, or when a customer or regulator asks for continuous evidence.
The free stack for a small business: run the passive checkers on each host, then let the Domain Monitor watch your verified domain for clones, lookalike certificates and typosquats.
Start with free monitoring →For the developer / IT
Before any vendor call, run the open-source loop from the ASM guide once and count what you find. Under 50 live hosts and no compliance mandate: stay on free tooling plus monitoring, spend the budget on reducing the surface instead. Over that, or with multiple business units, shortlist two EASM vendors and insist the trial runs from a seed domain only — the quality of unseeded discovery is the whole product.