TOOL TYPE · VAL
What is exposure validation? Proving which exposures are exploitable
SHORT ANSWER
Exposure validation tests whether an attacker could actually use an exposure, instead of inferring risk from a version number or a severity score. Approaches range from safe, non-intrusive checks to continuous attack-style testing that proves impact. It is the step that turns a long list into a short one you can trust.
By The Exposure Desk · Exposure Management Finder · Published 2026-10-11
Desk research from public vendor pages read in September 2026, updated 2026-10-11. Profiles follow our published method; we did not run the products.
What does exposure validation do?
A discovery tool might report that a server runs a version of software with a known vulnerability. Validation asks the next question: can that vulnerability be reached and used from the internet, as configured, today?
Safe checks confirm exploitability without changing anything on the target, for example by sending a request that reveals whether a vulnerable path responds. Attack-style testing goes further and simulates what an attacker would do, sometimes with automated agents that chain steps together, to prove impact.
Validation also works after a fix: running the same test again shows whether the fix closed the exposure. Some vendors describe this retest; others do not.
When do you need it?
- Your backlog is long and most findings carry the same severity.
- Engineering teams push back on findings they believe are false positives.
- You need evidence for a risk decision, not an estimate.
- New critical vulnerabilities appear faster than you can patch, and you need to know which of your assets are actually affected.
Where does it stop?
Validation only tests what discovery found. An asset missing from the inventory will not be tested. And proving that an exposure is exploitable does not fix it: someone still has to patch, reconfigure or put a compensating control in front of it.
Which finder answers point to VAL?
- +2 if your answer to "Which security platform or scanner do you already run?" is "A vulnerability scanner from another vendor"
- +3 if your answer to "How much proof do you need that an exposure is real?" is "Safe, non-intrusive checks that it is exploitable"
- +5 if your answer to "How much proof do you need that an exposure is real?" is "Attack-style testing that proves impact"
- +1 if your answer to "How much capacity does your team have to fix things?" is "Findings get fixed within our targets"
- +1 if your answer to "How much capacity does your team have to fix things?" is "The backlog grows faster than we close it"
Which vendors describe VAL?
7 of 10 vendors describe exposure validation on the pages we read, and 3 are not in our sources.
| Vendor | Status | What their pages say | Source |
|---|---|---|---|
| Censys ASM | Described | Confirms reachability and applies EPSS and KEV; active exploitation testing is not described. | Source: Censys external exposure management · Read 27 Sep 2026 |
| Cortex Xpanse | Not in our sources | Not described on the pages we read. | None |
| CrowdStrike EASM | Not in our sources | Not described on the pages we read. | None |
| CyCognito | Described | More than 100,000 tests across 30+ categories, unauthenticated and designed not to change state. | Source: CyCognito active security testing · Read 27 Sep 2026 |
| Hadrian | Described | Agentic AI that, by Hadrian's account, proves exploitability within 15 minutes. | Source: Hadrian technology · Read 27 Sep 2026 |
| IONIX | Described | Non-disruptive active exploitability testing; for new CVEs, safe, non-intrusive validation tests built from public proof-of-concept exploits. | Source: IONIX Live Exposure Defense · Read 11 Oct 2026 |
| Microsoft Defender EASM | Not in our sources | Not described on the pages we read. | None |
| Rapid7 Surface Command | Described | Rapid7 announced runtime validation for Exposure Command in March 2026, aimed at cloud vulnerabilities; active validation is not described for Surface Command. | Source: Rapid7 press release: runtime validation and DSPM for Exposure Command · Read 27 Sep 2026 |
| Tenable Attack Surface Management | Described | Tenable One adds attack path analysis across 150+ techniques; exploit testing is not described for the ASM product. | Source: Tenable One · Read 27 Sep 2026 |
| watchTowr | Described | Automated red teaming with eight agents: infrastructure, web application, known exploited vulnerabilities, credential stuffing, cloud, sensitive data, third party and supply chain, and DNS. | Source: watchTowr platform · Read 27 Sep 2026 |
Not in our sources is not a no. Ask the vendor, and send us a public source if one exists.
What should you ask a vendor?
- Are your tests safe for production, and what exactly do they change, if anything?
- Do you prove impact with attack-style testing, or confirm exploitability with checks?
- How quickly do you test for a newly published vulnerability across our assets?
- Do you retest after we fix something, and is that automatic?
Questions readers ask
Is exposure validation the same as penetration testing?
They overlap. A penetration test is usually a time-boxed engagement by people or tools. Exposure validation runs continuously or on demand across the whole external estate. Some vendors here sell both: Hadrian publishes a per-test price for agentic penetration tests.
Is attack-style testing safe?
Vendors design it to be. CyCognito describes unauthenticated tests with no brute force or state changes, and IONIX describes non-intrusive exploit simulations. Ask any vendor what its tests change before you allow them on production.
What is adversarial exposure validation?
A term for testing that uses attacker techniques to prove which exposures are exploitable. Hadrian states it is named in Gartner's 2026 Market Guide for Adversarial Exposure Validation.