Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. The largest vendors in attack surface management software
cannot hold places 1 to 3. Places 1 to 3 go to challengers, vendors outside the best-known brands in a category,
wherever the category has them; the established names follow from place 4 in their ranked order. How it works: placement disclosure ·
editorial process.
The 11 tools, reviewed
#1 Intruder
Attack surface scanning with a free tier · United Kingdom · intruder.io
free tier per-target pricing cloud checks
Intruder takes first place because a buyer can learn the product before any sales call. The Free plan allows 3 users, weekly external scans, one cloud account and monitoring of ports 80 and 443, and a 14-day trial of Cloud and Pro comes with 5 free licences. Cloud adds unlimited users, daily cloud checks and daily container image scans.
- Pricing: Base fee + per target. Free plan forever, then Cloud, Pro and Enterprise. Free plan: free plan.
- Best for: Small teams starting from nothing
- Strengths: Weekly external scans on Free; Cloud account checks; Container image scans.
Where it falls short
Cloud and Pro prices are hidden and no currency is stated, so a budget needs a quote. The free tier is narrow: one scheduled scan a month and monitoring on two ports.
Wrong for
A buyer who needs a full price list before talking to anyone, or a large organization with hundreds of domains where per-target billing grows quickly.
Visit Intruder →
#2 Detectify
Surface monitoring and web scanning, priced in euro · Sweden · detectify.com
euro pricing surface monitoring API scanning
Detectify comes second because its price page lets a buyer place the product before a call. Starter costs nothing as an annual platform fee for up to 5 users, Standard is from EUR 2,500 with 2 hours of onboarding, and Professional from EUR 5,000 adds unlimited users and a customer success manager.
- Pricing: Platform fee + usage. Platform fee from EUR 0 (Starter), EUR 2,500 (Standard), EUR 5,000 (Professional) and EUR 15,000 (Enterprise), plus usage costs per asset, domain, IP range and target. Free plan: free trial.
- Best for: Teams wanting a published price ladder
- Strengths: Surface Monitoring; API Scanning; Dynamic Fuzzing.
Where it falls short
The platform fee is only the start: extra assets, domains, environments and IP ranges are billed on top, and surface monitoring is priced per domain. Standard stops at 10 users.
Wrong for
A buyer who needs one all-in monthly figure, since usage costs make the total hard to predict.
Visit Detectify →
#3 Halo Security
External attack surface plans priced by target · United States · halosecurity.com
published price per target pentest add-on
Halo Security earns third place on openness: the start page shows a $399 monthly entry price, monthly or annual billing, and a free trial of up to 100 targets without a credit card. Add-ons are priced in the open too, with application scanning at $60 per target per month, compliance reporting at $100 a month and manual penetration testing from $3,950.
- Pricing: Per target / month. The base external attack surface plan starts at $399 a month, billed monthly or annually and priced on targets scanned. Free plan: free trial.
- Best for: Small estates wanting a clear entry price
- Strengths: Attack surface management; Target-based scanning; Application scanning add-on.
Where it falls short
There is no free plan, only a trial. Organizations with over 100 internet-facing assets are sent to enterprise plans with no price shown. Application scanning is charged per target, so costs rise quickly when many sites need deeper checks.
Wrong for
A company with a large estate above 100 assets, which the page moves to enterprise pricing without figures.
Visit Halo Security →
#4 Censys
Internet data and attack surface plans with API access · United States · censys.com
API access data history quote only
Censys sits fourth because its plans are described in concrete limits instead of adjectives. Core lists 20K Enrichment API calls a day, one month or more of data history and 15 or more collections. Adversary Investigation extends history to three months or more. Security Operations lists unlimited users, unlimited API calls, twelve months or more of history and unlimited collections.
- Pricing: Quote only. Core, Adversary Investigation and Security Operations are all quote-only. Free plan: none.
- Best for: Analyst teams that query scan data
- Strengths: Core plan; Enrichment API; Data history 1 to 12+ months.
Where it falls short
No prices appear on the pricing page, and no currency is shown for any plan. The free entry covers only standard ports and services and is not described as a plan or trial.
Wrong for
A company without analyst time that wants guided clean-up of its asset list. Intruder or Halo Security start with a simpler self-serve path, and Hadrian automates more of the contextual work.
Visit Censys →
#5 Hadrian
Exposure management plus agentic pentesting · Netherlands · hadrian.io
agentic pentesting automation European vendor
Hadrian takes fifth place as the most testing-minded of the European products. Its page describes Atlas as continuous external exposure management and Nova as on-demand agentic pentesting, summed up as finding an exposure and then proving how far it goes. An Orchestrator AI monitors the surface for changes, and the page claims an average saving of 10 working hours from automating discovery and contextualization.
- Pricing: Quote only. The page names no price, plan or trial and links to a separate pricing page; a free external scan is offered. Free plan: none.
- Best for: Teams wanting findings proven by testing
- Strengths: Atlas exposure management; Nova on-demand pentesting; Orchestrator AI.
Where it falls short
The page read states no price, plan limits or free trial, only a link to a pricing page. The free external scan is a sample, not a trial. Several claims, such as the time saved, are the vendor's own figures without a stated method.
Wrong for
A buyer who needs a price before a call, or a company that wants only a list of assets with no testing.
Visit Hadrian →
#6 Tenable Attack Surface Management
Attack surface mapping from a vulnerability management vendor · United States · tenable.com
incumbent vendor asset mapping business context
Tenable's product earns sixth place for a narrower audience. The page describes an attack surface map of more than 5 billion assets used to identify domains related to those in your inventory, and more than 200 metadata fields to supply business context. It can also start new scans of assets you have not yet assessed.
- Pricing: Quote only. No price is listed for this product; the calls to action are a demo request, a contact page and a chat with sales. Free plan: none.
- Best for: Existing Tenable customers
- Strengths: Attack surface map; 200+ metadata fields; Business context.
Where it falls short
The product page lists no price and no free trial, and says trials exist for other Tenable products, not this one. Every route starts with a demo, a contact form or a sales chat.
Wrong for
A small team that wants to try the product on its own domain without talking to sales.
Visit Tenable Attack Surface Management →
#7 Rapid7 Surface Command
Unified asset inventory and attack surface view · United States · rapid7.com
CAASM blast radius incumbent vendor
Rapid7 Surface Command takes seventh place because it covers more than the internet edge. The page lists asset discovery and a unified inventory, known as CAASM, as core capabilities, alongside blast radius analysis. Continuous monitoring is said to protect internal and external inventories, and native and third-party enrichment is used to rank remediation.
- Pricing: Quote only. The page links to packages without stating prices, and the footer offers contact sales and a demo tailored to the environment. Free plan: none.
- Best for: Rapid7 customers wanting one inventory
- Strengths: Asset discovery; Unified inventory (CAASM); Blast radius analysis.
Where it falls short
No prices are stated, and the page says Start a Surface Command trial without saying whether it is free. The wider scope means a bigger deployment than a pure external scanner, and the pages read give no limits or plan tiers.
Wrong for
A company that only wants an outside-in list of domains and exposed services.
Visit Rapid7 Surface Command →
#8 SecurityScorecard
Security ratings with a free own-domain score · United States · securityscorecard.com
security ratings free account supplier risk
SecurityScorecard sits eighth because it answers a different question from the products above it. The Free Forever account gives a security rating for your own domain, questionnaire responses and pre-built dashboards, with no limit on users viewing the free scorecard. Paid tiers add monitoring of other organizations, counted in organizations monitored or managed, and a trial exists for TITAN Watch. TITAN MAX is a managed tier delivered mostly through partners.
- Pricing: Per organization monitored. A Free Forever account rates your own domain; paid TITAN Watch, Assess and Secure have hidden prices with limits counted in organizations monitored, and TITAN MAX is quoted. Free plan: free plan.
- Best for: Supplier programs and external scorecards
- Strengths: Free security rating; TITAN Watch; TITAN Assess.
Where it falls short
It is not built to enumerate and test your own assets, so it replaces little of what discovery tools do.
Wrong for
A security lead who needs a complete inventory of domains, certificates and exposed services to clean up.
Visit SecurityScorecard →
#9 Bishop Fox Cosmos
Continuous attack surface testing from a security consultancy · United States · bishopfox.com
continuous testing reconnaissance post-exploitation
Bishop Fox ranks ninth because the offer leans toward testing, which is more than many small buyers need to begin. Its page describes Deep Attack Reconnaissance that recreates information gathering techniques such as active scanning, and Exploit Likelihood Analysis that calculates the probability of exploitation from contributing factors. Post-Exploitation Execution is optional and demonstrates what a skilled adversary could do with discovered vulnerabilities, and Targeted Remediation gives prescriptive guidance.
- Pricing: Quote only. The continuous testing page states no price; the call to action is Get Started, and no trial or free plan appears. Free plan: none.
- Best for: Buyers wanting adversary-style testing
- Strengths: Deep Attack Reconnaissance; Exploit Likelihood Analysis; Post-Exploitation Execution.
Where it falls short
No price, plan or trial appears on the page read, and the main call to action is a contact request. The page is written in capability terms, so limits such as asset counts or scan frequency are unknown until a sales call.
Wrong for
A team that wants self-serve signup and a visible price.
Visit Bishop Fox Cosmos →
#10 CyCognito
Autonomous validation and asset attribution · United States · cycognito.com
validation asset attribution risk prioritization
CyCognito comes tenth because its strengths address estates larger than most small buyers run. The homepage describes a Target Graph that keeps shadow AI and forgotten assets in scope, Autonomous Validation that sends real payloads to every exposed asset, and automatic attribution of each asset to its owner.
- Pricing: Quote only. No published price or plan was found on the pages read; the vendor sells through demo and contact. Free plan: none.
- Best for: Larger estates wanting validated findings
- Strengths: Target Graph; Autonomous Validation; Business and Tech Context.
Where it falls short
No price, plan limit or trial appears on the pages read, so a buyer cannot size a budget in advance. The claims about prioritization and validation are the vendor's own and give no thresholds.
Wrong for
A small company with a few domains and no spare analyst time to review validated findings.
Visit CyCognito →
#11 Recorded Future Attack Surface Intelligence
Attack surface discovery from a threat intelligence vendor · United States · recordedfuture.com
threat intelligence M&A due diligence certificate checks
Recorded Future closes the list at eleventh because the product serves a particular buyer. The page says it finds forgotten assets, shadow IT and third-party infrastructure from historical DNS, WHOIS and SSL/TLS certificate data, ranks exposures by exploitability and active threat activity, and identifies exposed assets in acquired companies. It also lists expired certificates, weak encryption and unauthorized cloud services as findings.
- Pricing: Quote only. No price is stated; the page offers a custom demo and a booking form, with no trial wording. Free plan: none.
- Best for: Threat intelligence customers
- Strengths: Historical DNS, WHOIS and TLS data; Exploitability ranking; M&A exposure checks.
Where it falls short
No price and no free trial are stated, and every route starts with a demo. The page is a feature list without limits or plan names.
Wrong for
A small company wanting a quick self-serve start.
Visit Recorded Future Attack Surface Intelligence →
Questions and answers
What is the best attack surface management software in 2026?
Intruder ranks first of 11, best for small teams starting from nothing. Detectify is second (teams wanting a published price ladder) and Halo Security third (small estates wanting a clear entry price). Places 1 to 3 go to challengers, vendors outside the best-known brands, wherever the category has them.
What is the difference between attack surface management and a vulnerability scanner?
A vulnerability scanner checks systems you point it at. Attack surface management starts earlier: it discovers which domains, subdomains, IP ranges and services belong to you, including ones nobody told the security team about, and then monitors them.
How much does attack surface management software cost?
Published prices are rare. Halo Security starts at $399 a month on a per-target basis, and Detectify lists platform fees of EUR 0, 2,500, 5,000 and 15,000 with usage costs on top.
Is there a free attack surface management tool?
Intruder has a free plan with weekly external scans for 3 users. Censys offers a free entry with basic visibility into standard ports and services. SecurityScorecard has a Free Forever account that rates your own domain.
Which attack surface management vendors are based in Europe?
Three on our list: Intruder, which gives a London registered office and English law, Detectify, a Swedish company with its address in Stockholm, and Hadrian, whose terms name Hadrian Security B.V. and the courts of Amsterdam.
What does external attack surface management mean?
External attack surface management, often shortened to EASM, covers only what an outsider can see: domains, public IP addresses, certificates, exposed services and web applications.
Do I need penetration testing as well as attack surface management?
Discovery tells you what is exposed, and testing tells you whether it can be exploited.
How long are the free trials?
Intruder offers a 14-day free trial on Cloud and Pro including 5 free licences, and each licence lasts 30 days once used on a target.
How is SecurityScorecard different from the other products?
SecurityScorecard sells security ratings. Its free account gives a rating for your own domain, and its TITAN tiers monitor organizations you manage, with limits counted in organizations. The other ten products are built to enumerate and test your assets.
What should I ask a vendor before signing?
Ask what counts as an asset in the contract, since Detectify, Halo Security and Intruder all bill by assets or targets. Ask which entity signs and under which law.
Can a small company use enterprise products such as Tenable or Rapid7?
Yes, though both sell by demo and quote, and Tenable lists no free trial for its attack surface product. Rapid7 mentions a Surface Command trial without saying whether it is free.
