The best attack surface management tools find every internet-facing asset you own, including the ones nobody remembers, and flag the exposures that matter: small teams can start with free scans and community editions, while large groups with many brands need continuous discovery and testing. Eleven options follow in no particular order.
Attackers don't start with your network diagram. They start with the internet, scanning for forgotten test servers, old marketing sites, open databases and login pages that someone set up and never shut down.
Attack surface management, or ASM, does the same discovery for you so you can fix things first. The eleven tools below are listed alphabetically and in no particular order, and every description comes from the vendor's own site, read this week. Email is often the softest edge, so see my guide to business email attacks as well.
ASM tools at a glance
In the free plan column, Yes means the tool's own site names a free plan, a free version, a free edition or open-source code. Trial only means a time-limited trial. Not stated means the pages I read named neither, even where there's a button inviting you to try it.
| Tool | Type | Good for | Free plan |
|---|---|---|---|
| Censys | Internet intelligence platform | Seeing what the internet sees about you | Not stated |
| Cortex Xpanse | Attack surface management | Large enterprises on Palo Alto Networks | Not stated |
| CyCognito | Exposure management | Finding unknown assets owned by subsidiaries | Not stated |
| Detectify | External application security testing | Web apps checked with hacker research | Trial only |
| FullHunt | Attack surface and internet intelligence | Developers checking their own domains | Yes |
| Hadrian | Continuous attack surface testing | Continuous pentesting of what you expose | Not stated |
| Intruder | Exposure management and vulnerability scanning | Small teams wanting clear, simple scanning | Not stated |
| Microsoft Defender EASM | External attack surface management | Organisations already on Microsoft security | Not stated |
| runZero | Exposure management and asset discovery | Finding every device, inside and out | Yes |
| Tenable Attack Surface Management | Attack surface management | Teams already using Tenable scanning | Not stated |
| UpGuard | Cyber risk posture management | Your own and suppliers' exposure | Yes |
Eleven attack surface tools to consider
Censys
Best for: Security teams that want internet-wide scan data to find their own exposed hosts, certificates and services.
Cortex Xpanse
Best for: Large organisations that want internet-facing assets discovered and risky exposures fixed automatically, from Palo Alto Networks.
CyCognito
Best for: Organisations with many brands and subsidiaries that want hidden external assets found and tested without lots of set-up.
Detectify
Best for: Product and security teams that want their external web apps tested with techniques sourced from ethical hackers.
FullHunt
Best for: Smaller teams and developers who want to search their domains for exposed assets, with a free starting point.
Hadrian
Best for: Organisations that want their external attack surface discovered and pentested continuously by an automated platform.
Intruder
Best for: Smaller businesses that want always-on scanning of their external systems and websites, with results explained in plain English.
Microsoft Defender EASM
Best for: Microsoft-centred organisations that want their external attack surface mapped inside the Defender and Azure tools they already use.
runZero
Best for: Teams that want every asset discovered, internal and external, with a completely free community edition for smaller environments.
Tenable Attack Surface Management
Best for: Existing Tenable customers running its vulnerability tools that want their internet-facing assets mapped in the same platform.
UpGuard
Best for: Businesses that want to watch their own external exposure and their vendors' security posture, with free instant checks.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
A free government baseline to compare against
CISA's Cyber Hygiene Vulnerability Scanning service continuously assesses an organisation's internet-accessible network assets for vulnerabilities and sends weekly reports of all findings, and CISA describes it as a service with no charge.
If you're an eligible US organisation, that gives you a free baseline. Run a vendor trial alongside it and compare what each finds, especially assets you didn't know about. Outside the US, free scans and community editions do a similar job.
Discovery first, then testing
Most tools in this space do two jobs. Discovery finds what you own: domains, subdomains, IP addresses, cloud services and certificates. Testing then checks those assets for exposed services, weak settings and known vulnerabilities.
The discovery part is where tools differ most. Ask how each one links assets back to your business, because a tool that misses your forgotten subsidiary's website has missed the point.
Questions to ask an ASM vendor
- How do you discover assets we haven't told you about?
- How do you avoid flagging assets that aren't ours?
- How often do you rescan, and how fast do new findings appear?
- Do you test what you find, or only list it?
- Can you cover subsidiaries and acquired brands?
- Which ticketing and security tools do findings flow into?
Signs your attack surface is out of control
- Old sites are still live. Campaign pages from years ago never came down.
- Teams launch cloud services on their own. IT finds out later.
- Acquired brands kept their old systems. Nobody has checked them since.
- Findings have no owner. The same issues show up every month.
Do you make attack surface management tools? Tool makers can ask to be considered for a featured place on this list.
My plain advice on choosing attack surface management tools
Start with a free scan or community edition before you sign up for anything. Even a quick look usually turns up something surprising, such as an old campaign microsite or a test server, and that tells you how big your blind spots are.
Then fix ownership. Every asset the tool finds needs a named owner, or the same findings will sit in a dashboard for months. For the wider basics, my notes on security essentials for customer-facing platforms are a good companion.
Frequently asked questions
What is attack surface management?
It's the ongoing process of discovering every internet-facing asset an organisation owns and checking those assets for exposures and vulnerabilities.
What is external attack surface management?
EASM focuses on what's visible from the internet, such as websites, domains, cloud services and exposed ports.
How is ASM different from vulnerability scanning?
Vulnerability scanning checks assets you already know about. ASM first finds the assets, including unknown ones, then checks them.
Are there free attack surface management tools?
Some vendors offer free scans or community editions. Check the free plan column in the table above.
Who needs attack surface management?
Any organisation with a website, cloud services or remote access has an attack surface. Larger groups with many brands get the most from continuous tools.
How often should I scan my attack surface?
Continuously if you can, because new assets and exposures appear whenever someone launches a site or changes a cloud setting.
