Exposure management FAQ: ASM, CTEM and choosing a tool

It finds the assets you expose to the internet, keeps that inventory current, and flags exposures on them. The better tools also show why each asset is yours and who owns it. See EASM discovery.

Vulnerability management scans known assets for known vulnerabilities. Exposure management starts from what an attacker can reach, including assets you did not know about, and asks which exposures are exploitable and what to do about them. See the five tool types.

EASM looks at external, internet-facing assets. CAASM combines internal and external asset data from many tools into one inventory. Rapid7 describes Surface Command as both. See the glossary.

Acquisitions, brands with their own IT, cloud accounts created by project teams and services left running after a project ends. Discovery tools exist for exactly this. See EASM discovery.

A programme for finding, ranking, proving and fixing exposures in repeated cycles, scoped to what matters to the business. See CTEM explained.

From Gartner's public press releases of 16 October 2023 and 22 February 2024, which forecast that by 2026 organisations prioritising security investments based on a CTEM programme will realise a two-thirds reduction in breaches. It is a forecast. See CTEM explained.

You can buy tools that support most of the cycle. The programme itself, scoping, decisions and ownership of fixes, is run by people. See CTEM programme support.

Pick something you can finish: the internet-facing assets of one business service or one acquisition. See Scoping a first CTEM cycle.

Testing whether an exposure can actually be exploited, from safe checks to attack-style testing. See exposure validation.

Safe checks confirm exploitability without changing the target; attack-style testing proves impact. Many teams start with safe checks on everything and use attack-style testing where the stakes are highest. See Safe checks or attack-style testing.

Something that reduces the risk of an exposure without fixing it, such as a WAF rule. It buys time while the fix is planned. See Compensating controls in practice.

Test again. Some vendors describe an automatic retest or regression test after a fix; others leave it to you. See Retesting and proof of fix.

If you run several WAF or CDN vendors, nobody may know which applications are protected and whether protection is enforced. WAF posture management answers that and turns new vulnerabilities into rules. See WAF posture.

Few do. On the pages we read, CyCognito, Hadrian and IONIX publishes a price, Censys ASM, Cortex Xpanse, Microsoft Defender EASM and Rapid7 Surface Command publish a pricing basis, a trial or a free account, and 3 quote through sales. See the vendor notes.

The unit a quote is based on, such as total asset volume, active IPs or billable assets. CyCognito and Microsoft publish theirs. Knowing it helps you check a quote.

Microsoft Defender EASM has a 30-day free trial and Rapid7 lists a public trial for Surface Command. Censys offers a free platform account. Others start with a sales conversation. Several vendors list plans on AWS Marketplace: IONIX, CyCognito and Hadrian.

CyCognito, IONIX and watchTowr describe WAF posture or pushing rules to the edge. See WAF posture.

CyCognito, Hadrian and watchTowr; IONIX describe safe checks but not attack-style testing. See exposure validation.

Tenable Attack Surface Management extends Tenable One, Rapid7 Surface Command the Rapid7 Command platform, Cortex Xpanse the Palo Alto Networks Cortex portfolio, Microsoft Defender EASM runs as an Azure resource, and CrowdStrike EASM sits in Falcon Exposure Management. See exposure management platforms.

Yes, as CrowdStrike EASM, the name CrowdStrike now uses under Falcon Exposure Management. Gartner Peer Insights still lists it as Falcon Surface. See CrowdStrike EASM notes.

IONIX's pages describe subsidiary attribution, non-intrusive exploit validation, WAF posture across 50+ WAF vendors, compensating controls applied for the customer, re-validation of fixed items and AWS Marketplace plans from $25,000 a month. Its validation is less aggressive than attack-style testing, internal assets are not described and no integrations list is published. See IONIX vendor notes.

No. The finder orders vendors by fit to your answers, using published rules; equal fits are shown alphabetically. See How we map.

Public vendor pages, documentation, pricing pages and press releases read in September 2026 and updated on 11 October 2026, plus public pages from Gartner, CISA and FIRST. No hands-on testing. See How we map.

Use the contact page with the topic Correction and a public source.