THE EXPOSURE DESK · METHOD

Nine exposure shapes and what the finder says for each

SHORT ANSWER

We ran the exposure finder on nine example organisations, from a single-brand Azure team to a Falcon customer with several brands. The cards below are computed by the finder itself, so they change when the data changes; this version reflects vendor facts updated on 11 October 2026.

By The Exposure Desk · Exposure Management Finder · Published 2026-10-11 · Updated 2026-10-13

Desk research from public vendor pages read in September 2026, updated 2026-10-11. Profiles follow our published method; we did not run the products.

3 min read

Why publish the test profiles?

A finder is only useful if it gives different people different answers. We keep nine example profiles as a build-time test: if a data change moves a result, the build fails until we check it. Publishing them lets you see how the rules behave before you answer the questions yourself.

Several brands, mixed hosting, another vendor's scanner

COMPUTED FINDER RESULT · SEVERAL BRANDS, MIXED HOSTING, ANOTHER SCANNER

How is your organisation put together? Several brands or business units
Where do your internet-facing systems run? A mix of cloud and on-premises
Which security platform or scanner do you already run? A vulnerability scanner from another vendor
How much proof do you need that an exposure is real? Safe, non-intrusive checks that it is exploitable
What sits in front of your web applications? One WAF or CDN vendor
How much capacity does your team have to fix things? The backlog grows faster than we close it

Start here
Exposure validation 6 pts

Also relevant
CTEM programme support 6 pts, EASM discovery 4 pts

First equal-fit group
IONIX, watchTowr

This is the default on the finder page. Safe proof and a growing backlog push exposure validation and CTEM programme support to the top. Two vendors come out as an equal fit.

Subsidiaries with several WAF vendors

COMPUTED FINDER RESULT · SUBSIDIARIES WITH SEVERAL WAF VENDORS

How is your organisation put together? Many subsidiaries, or acquisitions in the last three years
Where do your internet-facing systems run? A mix of cloud and on-premises
Which security platform or scanner do you already run? A vulnerability scanner from another vendor
How much proof do you need that an exposure is real? Safe, non-intrusive checks that it is exploitable
What sits in front of your web applications? Several WAF vendors across teams or subsidiaries
How much capacity does your team have to fix things? We need fixes or compensating controls applied through tools we already own

Start here
WAF posture 8 pts

Also relevant
CTEM programme support 7 pts, EASM discovery 6 pts

First group
IONIX

Many subsidiaries, several WAF vendors and too little capacity to fix make WAF posture the starting type. Subsidiary attribution and WAF coverage across vendors are the checks that separate the vendors here.

One brand on Azure and Microsoft

COMPUTED FINDER RESULT · ONE BRAND ON AZURE AND MICROSOFT

How is your organisation put together? One organisation with one main brand
Where do your internet-facing systems run? Mostly public cloud
Which security platform or scanner do you already run? Microsoft (Azure or Microsoft Sentinel)
How much proof do you need that an exposure is real? A prioritised list is enough for now
What sits in front of your web applications? No WAF or edge protection
How much capacity does your team have to fix things? The backlog grows faster than we close it

Start here
EASM discovery 4 pts

Also relevant
Exposure management platforms 3 pts, CTEM programme support 3 pts

First group
IONIX

A single brand that only needs a list, already on Microsoft, sees IONIX just ahead of Microsoft Defender EASM. IONIX's pages name a Microsoft Sentinel integration and a marketplace price; Defender EASM extends the platform the team runs and offers a free trial.

Several brands wanting attack-style proof

COMPUTED FINDER RESULT · SEVERAL BRANDS WANTING ATTACK-STYLE PROOF

How is your organisation put together? Several brands or business units
Where do your internet-facing systems run? Mostly public cloud
Which security platform or scanner do you already run? None of these
How much proof do you need that an exposure is real? Attack-style testing that proves impact
What sits in front of your web applications? One WAF or CDN vendor
How much capacity does your team have to fix things? Findings get fixed within our targets

Start here
Exposure validation 6 pts

Also relevant
EASM discovery 5 pts

First equal-fit group
IONIX, watchTowr

Asking for attack-style testing moves exposure validation to the top. watchTowr and IONIX come out level: watchTowr describes attack-style testing, while IONIX describes safe tests plus re-validation of fixed items and named cloud integrations.

Tenable shop with a growing backlog

COMPUTED FINDER RESULT · TENABLE SHOP WITH A GROWING BACKLOG

How is your organisation put together? Several brands or business units
Where do your internet-facing systems run? A mix of cloud and on-premises
Which security platform or scanner do you already run? Tenable
How much proof do you need that an exposure is real? A prioritised list is enough for now
What sits in front of your web applications? No WAF or edge protection
How much capacity does your team have to fix things? The backlog grows faster than we close it

Start here
EASM discovery 5 pts

Also relevant
Exposure management platforms 5 pts, CTEM programme support 4 pts

First group
Tenable Attack Surface Management

Running Tenable already adds points to exposure management platforms and to Tenable's own product.

Subsidiaries on Palo Alto Networks

COMPUTED FINDER RESULT · SUBSIDIARIES ON PALO ALTO NETWORKS

How is your organisation put together? Many subsidiaries, or acquisitions in the last three years
Where do your internet-facing systems run? Mostly public cloud
Which security platform or scanner do you already run? Palo Alto Networks (Cortex XSOAR or Prisma Cloud)
How much proof do you need that an exposure is real? A prioritised list is enough for now
What sits in front of your web applications? No WAF or edge protection
How much capacity does your team have to fix things? We need fixes or compensating controls applied through tools we already own

Start here
EASM discovery 7 pts

Also relevant
CTEM programme support 4 pts

First group
Cortex Xpanse

Here the platform owner comes out first, with a specialist that names Cortex XSOAR and Prisma Cloud among its integrations next.

One brand wanting proof and a visible price

COMPUTED FINDER RESULT · ONE BRAND WANTING PROOF AND A VISIBLE PRICE

How is your organisation put together? One organisation with one main brand
Where do your internet-facing systems run? Mostly public cloud
Which security platform or scanner do you already run? None of these
How much proof do you need that an exposure is real? Attack-style testing that proves impact
What sits in front of your web applications? No WAF or edge protection
How much capacity does your team have to fix things? Findings get fixed within our targets

Start here
Exposure validation 6 pts

Also relevant
EASM discovery 4 pts

First group
IONIX

A single brand that wants attack-style proof and a visible price sees IONIX first, with CyCognito and Hadrian next. All three list prices: IONIX on AWS Marketplace from $25,000 a month, CyCognito $30,000 a year for 250 assets, Hadrian from 1,250 euros per test excluding VAT or $50,000 a year for 250 assets.

On-premises Rapid7 shop

COMPUTED FINDER RESULT · ON-PREMISES RAPID7 SHOP

How is your organisation put together? One organisation with one main brand
Where do your internet-facing systems run? Mostly on-premises data centres
Which security platform or scanner do you already run? Rapid7
How much proof do you need that an exposure is real? A prioritised list is enough for now
What sits in front of your web applications? No WAF or edge protection
How much capacity does your team have to fix things? The backlog grows faster than we close it

Start here
Exposure management platforms 6 pts

Also relevant
EASM discovery 3 pts, CTEM programme support 3 pts

First group
Rapid7 Surface Command

Mostly on-premises hosting and Rapid7 already in place put platforms first and Rapid7's own product ahead.

Falcon customer with several brands

COMPUTED FINDER RESULT · FALCON CUSTOMER WITH SEVERAL BRANDS

How is your organisation put together? Several brands or business units
Where do your internet-facing systems run? Mostly public cloud
Which security platform or scanner do you already run? CrowdStrike Falcon
How much proof do you need that an exposure is real? A prioritised list is enough for now
What sits in front of your web applications? No WAF or edge protection
How much capacity does your team have to fix things? The backlog grows faster than we close it

Start here
EASM discovery 5 pts

Also relevant
CTEM programme support 4 pts, Exposure management platforms 3 pts

First equal-fit group
IONIX, watchTowr

IONIX and watchTowr come out level, with Cortex Xpanse next. CrowdStrike EASM gets the platform points but sits in a two-way tie for fourth with CyCognito, because the page we read does not describe validation, ticket routing or mitigation.

What do the results show?

Five different vendors appear in a first group across nine profiles, and three profiles end in an equal fit. IONIX is in the first group in six of the nine and alone in three. That reflects how much its pages now describe, including a marketplace price and re-validation of fixes. It is not first for a Tenable or Rapid7 shop, it is second to Cortex Xpanse for a Palo Alto Networks group, and its validation is less aggressive than watchTowr's or Hadrian's.