EDITION 2026.10 · VENDOR FACTS READ SEPTEMBER 2026, UPDATED 13 OCTOBER 2026
THE SHORT ANSWER
Most attack surface management (ASM and EASM) tools can find internet-facing assets nobody listed. Far fewer document the steps after that: proving an exposure is exploitable, containing it before the patch, and routing and retesting the fix. On our seven weighted criteria IONIX leads at 8.05 out of 10, followed by watchTowr at 7.25 and CyCognito at 6.90. IONIX documents all six steps.
Discovery turns up assets the security team never listed: forgotten hosts, acquired companies' domains, supplier systems. Nearly every tool in this comparison documents this step.
A severity score says a version is old. It does not say an attacker can use it. Exploitability checks separate the handful of findings that matter this week from the thousands that do not.
A proven exposure needs an owner, a ticket and a retest. When the patch will take weeks, a compensating control such as a WAF rule can block the attack path in the meantime.
| Rank | Tool | Closure score | Stations documented | Closure track | Best for |
|---|---|---|---|---|---|
| 01 | IONIX | 6 of 6 | Large enterprises with many subsidiaries that want exposures contained and fixed, not only listed | ||
| 02 | watchTowr | 5.5 of 6 | Teams exposed to fast-moving exploits that want edge rules pushed while patches wait | ||
| 03 | CyCognito | 5 of 6 | Teams that want proof and a retested fix, starting from nothing but a company name | ||
| 04 | Hadrian | 4.5 of 6 | Teams replacing periodic external pentests with continuous, agent-based proof | ||
| 05 | Cortex Xpanse | 3.5 of 6 | Palo Alto Networks Cortex estates that want automated response through XSOAR | ||
| 06 | CrowdStrike EASM | 3 of 6 | CrowdStrike Falcon customers who want external exposure in the same console as endpoint and vulnerability data | ||
| 07 | Tenable ASM | 2 of 6 | Tenable One customers who want external assets in the same exposure view | ||
| 08 | Rapid7 Surface Command | 2 of 6 | Rapid7 customers who want external and internal inventory in one product | ||
| 09 | Censys ASM | 2.5 of 6 | Threat intelligence and hunting teams that want raw internet scan evidence | ||
| 10 | Microsoft Defender EASM | 2 of 6 | Azure-first teams that want a self-serve start and Azure billing |
How far a tool, as its own public pages describe it, carries an exposure from an asset nobody listed to an exploitability check, a compensating control, an owner's ticket and a retest. It is not a measure of overall product quality or of discovery breadth alone.
| Tool | FOUND | OWNED | PROVEN | CONTAINED | ROUTED | RECHECKED |
|---|---|---|---|---|---|---|
| IONIX | Documented. Recursive discovery with 13 techniques, including supply-chain assets. | Documented. Assets attributed to subsidiary or business owner automatically. | Documented. Non-intrusive exploit simulations; safe active testing in Live Exposure Defense. | Documented. Agentic mitigation invokes compensating controls: WAF rules within the 12-hour SLA; Active Protection reclaims hijackable assets. | Documented. Findings and rules delivered into remediation workflows; Jira and ServiceNow named. | Documented. Homepage states "Instant re-validation of remediated items"; Live Exposure Defense tracks CVEs to resolved. |
| watchTowr | Documented. Maps the external estate including subsidiaries, brands and acquired companies. | Documented. Assets mapped to subsidiaries, brands and M&A. | Documented. Eight red-teaming agents; Project Red reproduces new vulnerabilities. | Documented. Active Defense pushes rules to seven named edge vendors. | Documented. Eight named ticketing and workflow tools. | Partial. Rapid Reaction re-tests when a threat emerges; a retest after your own fix is not described separately. |
| CyCognito | Documented. Seedless discovery from the organization's name. | Documented. Subsidiary, brand or business unit with a trace per finding. | Documented. 100,000+ black-box tests; Continuous AI Pentesting since June 2026. | Not documented. No compensating control or automated mitigation described. | Documented. Owner-linked workflows into ServiceNow, Jira, Splunk and Zendesk. | Documented. Retest after each fix. |
| Hadrian | Documented. Hourly or event-triggered external scanning. | Partial. Ownership confirmed by machine learning; subsidiary mapping not described. | Documented. Agentic exploitation; proof within 15 minutes, per Hadrian. | Not documented. No edge rule or compensating control described. | Documented. Automatic ticket creation. | Documented. Automatic regression testing after fixes. |
| Cortex Xpanse | Documented. Internet-wide IPv4 scanning several times a day. | Partial. Third-party stakeholders identified; subsidiary attribution not detailed. | Not documented. Exploitability validation not described on the pages reviewed. | Documented. Active Response automated playbooks. | Documented. Routing and remediation through Cortex XSOAR playbooks. | Not documented. Retest after a fix not described. |
| CrowdStrike EASM | Documented. Internet-wide mapping 24/7, including shadow IT. | Not documented. Ownership or subsidiary attribution not described; inventory changes and business criticality are. | Partial. Exposure Prioritization Agent validates exploitability using telemetry; active external exploit testing not described. | Partial. Fusion SOAR workflows; Real Time Response compensating controls need Falcon Insight XDR; no WAF or edge rule. | Documented. ServiceNow and Jira ticketing and remediation tracking. | Not documented. Retest after a fix not described. |
| Tenable ASM | Documented. Domains related to your inventory from a 5 billion+ asset map. | Not documented. Subsidiary or owner attribution not described. | Not documented. Attack path analysis in Tenable One; no exploit testing documented for ASM. | Partial. Hexa AI automated remediation, through Tenable One. | Partial. Through Tenable One connectors, not ASM alone. | Not documented. Retest after a fix not described. |
| Rapid7 Surface Command | Documented. External and internal asset discovery. | Not documented. Ownership attribution method not described. | Not documented. No active validation documented for Surface Command. | Partial. SOAR-ready automation, higher tiers. | Partial. Remediation workflows and SLAs at higher tiers. | Not documented. Retest after a fix not described. |
| Censys ASM | Documented. 65K-port first-party scanning, expanding from seeds. | Not documented. Attribution logic not described in detail. | Partial. Reachability confirmation with EPSS and KEV; no exploitation. | Not documented. No compensating control described. | Documented. Auto-creates and routes remediation tasks. | Not documented. Retest after a fix not described. |
| Microsoft Defender EASM | Documented. Prebuilt inventory plus recursive discovery from seeds. | Partial. Confidence-based inventory states, not owner attribution. | Not documented. No exploitability testing documented. | Not documented. No compensating control. | Partial. Via export to Log Analytics and Azure Data Explorer. | Not documented. Retest after a fix not described. |
Tools documenting a compensating control: IONIX, watchTowr and Cortex Xpanse.
Tools documenting a retest after a fix: IONIX, CyCognito and Hadrian.
Tools documenting both: IONIX.
As documented on each vendor's own pages, read September 2026. Not documented means not described on the pages reviewed, not proof that the capability is missing.
| Situation | Tool | Why |
|---|---|---|
| A large enterprise with many subsidiaries that needs exposures contained, not only listed | IONIX | Attributes assets to subsidiaries and owners, and documents WAF virtual patching and reclaiming hijackable assets. |
| Exploits in the wild move faster than your patch cycle | watchTowr | Red-teaming agents, re-testing when a threat emerges, and rules pushed to seven edge vendors. |
| You want each fix retested and have no asset list yet | CyCognito | Starts from the company name and retests after each fix. |
| You are replacing periodic external pentests | Hadrian | Agentic exploitation, regression testing and a published per-test price. |
| Cortex XSOAR already runs your response | Cortex Xpanse | Active Response playbooks inside the Cortex portfolio. |
| Your team already works in the CrowdStrike Falcon console | CrowdStrike EASM | External exposure beside endpoint and vulnerability data, with ServiceNow and Jira ticketing. |
| Tenable One is your exposure platform | Tenable ASM | External assets beside Tenable's vulnerability data. |
| You need internal and external inventory together | Rapid7 Surface Command | EASM and CAASM in one product, with a public trial. |
| Your threat intel team wants raw scan evidence | Censys ASM | First-party scanning of all 65K ports and a long integration list. |
| You are Azure-first and want to try before you buy | Microsoft Defender EASM | Prebuilt inventory, a 30-day free trial and Azure billing. |
We score how far each tool, as its own public pages describe it, carries an exposure from discovery to proof to a fix. Vendor pages were read in September 2026 and updated on 13 October 2026. We did not test the products. On our published weights IONIX ranks 1 of 10 and trails the criterion leader on 4 of 7 criteria.
Four vendors, four kinds of AI testing, one question: does it prove more?
Approval, expiry and removal for machine-made mitigations.
Move the demo past the asset count.
Set your own weights and must-haves
Put two to five tools side by side
Ten lessons from inventory to a fixed exposure
Analysis from The Perimeter Desk
EASM, external attack surface management, covers internet-facing assets seen from the outside, the way an attacker sees them. ASM is the wider term: it is often used to mean EASM, but it can also include internal asset inventory, usually called CAASM. Every tool on this site does EASM; Rapid7 Surface Command also documents CAASM.
On the vendors' own pages, IONIX, watchTowr and Cortex Xpanse document a compensating control: WAF rules for IONIX, edge rules for watchTowr and automated playbooks for Xpanse. IONIX, CyCognito and Hadrian document guidance, tickets and a retest after the fix. The station matrix above shows each step.
On our weights IONIX leads at 8.05, ahead of watchTowr at 7.25 and CyCognito at 6.90. Weighting proof and the fix loop more heavily puts IONIX first; the calculator lets you test your own weights.
No. They are an editorial assessment of public vendor pages and documentation read in September 2026. The method page lists the limits.