Attack surface management software finds the domains, IP addresses, cloud services and applications a company exposes to the internet, including ones no one recorded, and flags the risky ones.
Twelve products are ranked by set-up effort, real cost, exit terms and independence from partners, and each entry says what the vendor's own pages leave unsaid.
Vendors can pay for visibility on this page. It never changes what an entry says about a product, including the criticism, and we earn nothing when you click through to a vendor. How that works.
In short
What attack surface management software does
Attack surface management software continuously discovers an organisation's internet-facing assets, attributes them to owners, checks them for exposures and routes the findings into ticketing and security tools.
Our order comes from five tests, taken in turn: effort to set up, what you really pay, what happens to your data on the way out, how locked in you are, and the intended customer. On top of them sits one rule. The top three places are for challengers, which means vendors outside the big names, where the category has any, and the household brands come in from fourth place. Our how we work page explains the choice of these five and why we give no mark out of ten.
Agentless external asset discovery sold in four asset-count tiers
Ranked #1 of 12 in Best Attack Surface Management Software in 2026.
Free tierPublished pricingElsewhere
Start the 30-day trial on your main domain and compare the billable count with your own domain list, because subdomains are what push a company out of a tier. Switch between passive and active scanning to see how much extra surface the active mode finds.
Check the alert routes to email, Slack and Jira, then look at the pre-built reports. Plan the step up early: the enterprise tier is custom and adds agentless traffic monitoring on request.
What stands out
Asset-count tiers
30-day trial
Agentless
Where it costs you
After the trial the free plan keeps only 40 assets and lets you view half of them, so it works as a taster rather than a working inventory.
The contracting party is Attaxion, LLC, yet no address appears in its terms or privacy policy, so the country is unconfirmed.
Right for
Lean security teams that want an external inventory priced before any sales call
Wrong for
Large estates needing wire payment, dedicated resources or traffic monitoring at list price
Not stated by the vendorPublished monthly or annual plans by asset count; 30-day trial, then a free plan
Surface Monitoring and web scanning, billed as platform fee plus extras
Ranked #2 of 12 in Best Attack Surface Management Software in 2026.
Published pricingEurope
For attack surface work, Detectify maps domains, subdomains, IPs, technologies and ports, then tests what it finds with real payloads. Payload testing keeps false alarms low, so developers still open the reports.
The price is breadth: it covers web-facing assets, with internal systems reachable through agents on Enterprise. A portfolio of two hundred marketing domains gets expensive, since each domain adds a fee on top of the tier.
What stands out
Annual platform fee
Per-domain extras
Trial
Where it costs you
Surface Monitoring is an extra charge per domain on every tier
Apex discovery and IP-range scanning only start at Professional
Right for
Companies with a small set of web applications and APIs worth mapping and testing
Wrong for
Owners of dozens of brand domains, or anyone who must inventory servers and devices
SwedenPublished annual platform fees by tier; extra charges per domain and per scan target; trial available
Amsterdam-built Atlas maps exposures and Nova runs agentic pentests on demand
Ranked #3 of 12 in Best Attack Surface Management Software in 2026.
Pricing on requestEurope
Begin with the free external scan on one domain, then ask for the Atlas quote with the asset count in hand, since that count drives the price.
Request the add-ons you actually need, namely the acquisition assessment or the infostealer credential leak detection, as separate lines. Use one test of Nova, listed per test, to judge whether validated findings reduce your triage hours before committing to the larger platform.
What stands out
Asset-based quote
Agentic pentesting
Cloud service
Where it costs you
The Atlas price is set by total asset count after a demo, so a buyer cannot compare it with listed plans.
The product page frames the company around agentic pentesting, which can mean paying for Nova when only an inventory is wanted.
Right for
Firms wanting discovery and proof of exploitability from one Dutch vendor
Wrong for
Buyers who want a self-serve price list and a plain asset inventory
NetherlandsAtlas quoted by total asset count; Nova pentests listed per test; demo required
Former Assetnote attack surface platform, now inside Searchlight Cyber
Ranked #4 of 12 in Best Attack Surface Management Software in 2026.
Pricing on requestEurope
Ask which of the former Assetnote capabilities you are buying today and which are bundled with Searchlight Threat, because the two products share one platform. Test the retest loop on one real finding: fix it, trigger the original exploit again and check the audit log entry.
Confirm the contract entity and renewal terms after the 2025 acquisition, and ask where your own data is held; the privacy notice says customer login data sits in the UK or EU.
What stands out
Demo-led sale
Exploit re-testing
Ex-Assetnote
Where it costs you
Only a demo booking is offered, without prices or a trial, so cost stays unknown until someone from sales replies.
Exposure is one half of a wider preemptive threat platform, so the company's focus is not limited to attack surface management.
Right for
Security teams that want findings proven exploitable and retested after the fix
Wrong for
Buyers who want published plans or a trial before talking to sales
United KingdomPricing on request via a demo booking; no rates shown on the page
Vulnerability scanner with an attack surface view, from a free plan up
Ranked #5 of 12 in Best Attack Surface Management Software in 2026.
Free tierPublished pricingEurope
Intruder started as a vulnerability scanner and treats attack surface monitoring as an extension. The free plan runs weekly external scans of ports 80 and 443, and wider port coverage grows with each tier up to all ports at Enterprise.
Findings are written so a developer can act directly. Finding forgotten assets is the costly part, because unknown-asset discovery sits only in the top plan, and very large estates outgrow it.
What stands out
Free plan
14-day trial
Tiered port monitoring
Where it costs you
Large internal networks get shallow coverage
Fine-grained scan settings are deliberately tucked away
Right for
Small firms wanting continuous external asset and port monitoring without a dedicated analyst
Wrong for
Mature security groups that expect deep control over scan configuration
United KingdomFree plan; 14-day trial offered; Pro and Enterprise sold through sales
Quote-based platform that discovers, attributes and tests external assets
Ranked #6 of 12 in Best Attack Surface Management Software in 2026.
Pricing on requestMiddle East
Fill in the quote form with an honest asset range, then ask for ASM alone first, because the other three services are sold on active IP and web application counts instead. Ask how ownership attribution is shown for a subsidiary domain you know well.
Compare the scanning frequency options, from monthly to daily, since frequency changes the price and applies to ASM and exposure validation, while AI pentesting is always on.
What stands out
Quote form
Owner attribution
AI pentesting
Where it costs you
No plan or price is listed; the quote form asks for asset range and scan frequency first.
Discovery is only the base layer, so the page steers buyers toward three further paid services.
Right for
Large organisations with subsidiaries who need assets tied to owners and business units
Wrong for
Small teams wanting self-serve signup or a published rate card
IsraelQuoted by asset volume and scan frequency; four separately sold services
Ranked #7 of 12 in Best Attack Surface Management Software in 2026.
Published pricingNorth America
Use the 21-day trial to scan a known external IP range with a runZero-hosted Explorer, then run an internal scan with your own Explorer and compare the two inventories.
A self-hosted console is optional, needs the Care support package and is arranged with sales. Watch the asset limit, which is counted per license, and confirm roadmap and support terms now that the company belongs to Dragos.
What stands out
Community Edition
21-day trial
Internal and external
Where it costs you
The Community Edition stops at 100 assets, 30 days of retention and 3 concurrent scans.
The pricing page describes scanning of ranges you supply and says nothing about subsidiary or acquisition mapping.
Right for
IT and OT teams that need internal and external asset inventories in one tool
Wrong for
Buyers wanting an attacker-view hunt for unknown domains and subsidiaries
United StatesPublished starting price; free Community Edition up to 100 assets; 21-day trial
Internet-scan dataset with a daily-updated attack surface module on top
Ranked #8 of 12 in Best Attack Surface Management Software in 2026.
Published pricingNorth America
Create the free account first and check how your standard ports and services appear on the map. Then request the ASM quote separately from the Platform plans, because the three Platform tiers (Core, Adversary Investigation, Security Operations) are aimed at investigations.
Ask how automated seed refresh keeps your list current and how cloud connectors handle accounts you do not know about. Credit packages for Platform use have a published entry level.
What stands out
Credit-based
Daily updates
Cloud connectors
Where it costs you
The ASM plan lists no price and points to a contact form.
Every query, export and dataset purchase consumes credits, so analyst use is hard to budget in advance.
Right for
SOC and threat-intel teams that want internet-wide data next to their own inventory
Wrong for
Small teams wanting a flat monthly price for asset discovery only
United StatesCredit packages published for Platform use; Attack Surface Management quoted; free account
Watches IP ranges you supply and alerts when something new is exposed
Ranked #9 of 12 in Best Attack Surface Management Software in 2026.
Published pricingElsewhere
Enter every known range from your registrar and hosting accounts, then compare the first results with your asset list; the gaps are your shadow IT. Pick the plan by monitored IPs and by the vulnerability filter, which starts at Small Business.
Use the on-demand scan to confirm a fix. Remember the API rate limit of one request per second if you plan to script the results into a ticketing tool.
What stands out
Monthly plans
IP monitoring
Alerts to Slack
Where it costs you
Monitored IPs are capped by plan, from 16 on the one-time Membership to 327,680 on Corporate.
It does not describe subsidiary, domain or cloud account discovery; you must know the ranges to watch.
Right for
Small teams wanting cheap alerts on known IP ranges and an API
Wrong for
Companies that do not yet know their own domains, ranges or subsidiaries
Not stated by the vendorPublished monthly API plans or one-time Membership; free account for the API
Open-source recon tools plus the Neo agent that runs attack surface discovery
Ranked #10 of 12 in Best Attack Surface Management Software in 2026.
Free tierSelf-hostablePublished pricingNorth America
The recon toolkit here is open source under MIT: subfinder, httpx, naabu and nuclei can all be run on your own machines. Nuclei checks are short YAML files, so you can read what triggers a finding and write checks for services nobody else runs.
The paid route is Neo, an AI agent. Expect to tune the output yourself, and note that the free tier is a one-time allowance rather than a standing plan.
What stands out
Free tier
MIT-licensed tools
Neo agent
Where it costs you
Installed package versions on hosts stay invisible
Noise level depends on how well you prune community templates
Right for
Engineers who prefer running scriptable discovery tools themselves over buying a hosted service
Wrong for
Organisations expecting a vendor-run programme that tracks fixes through to closure
United StatesFree tier with limited one-time usage; pay-as-you-go seats; Enterprise quoted
History-based asset discovery sold as a module of the Recorded Future platform
Ranked #11 of 12 in Best Attack Surface Management Software in 2026.
Pricing on requestNorth America
Ask for the demo with your own domain loaded, and check whether dormant dev environments or divested subsidiaries from your history appear.
Confirm what is in the Attack Surface Intelligence module and what needs other Recorded Future modules, and get this in the quote. The listed integrations include Splunk, Palo Alto XSOAR, Tines and ServiceNow, so match them to your ticketing flow before signing.
What stands out
Demo-led sale
DNS and WHOIS history
Platform module
Where it costs you
The product page lists no price, trial or tiers, only a custom demo.
Value depends on the surrounding Recorded Future intelligence platform, which a pure inventory buyer may not need.
Right for
Enterprises already using threat intelligence that want exposures ranked by active threat activity
Wrong for
Buyers wanting a standalone, self-serve or listed-price asset inventory
United StatesDemo-led pricing on request; the module page lists no rates
External asset mapping sold inside the Tenable One exposure platform
Ranked #12 of 12 in Best Attack Surface Management Software in 2026.
Pricing on requestNorth America
Ask for a demo that shows an unknown domain flowing from discovery into the vulnerability view. Check how the filters, tags and datatypes handle brand domains and acquired subsidiaries, and which of the 200 metadata fields you will actually use.
Request the price for the ASM product alone and as part of Tenable One, because the platform page positions it as a component rather than a stand-alone licence.
What stands out
Demo-led sale
Platform module
Asset map
Where it costs you
The page offers a demo request and a data sheet, with no rates or trial.
The value is highest when other Tenable One products are already in place.
Right for
Organisations already scanning with Tenable that want external assets in the same view
Wrong for
Buyers who want a standalone product with a listed price
United StatesPricing on request through a demo; part of the Tenable One platform
Attack surface management software continuously discovers an organisation's internet-facing assets, attributes them to owners, checks them for exposures and routes the findings into ticketing and security tools. Differences that change the outcome seldom sit in the features. Here is the sequence we would follow.
01
Work out how much a sales call is worth to you
Prices are public at 7 products (Attaxion, Detectify, Intruder, runZero, Censys, Shodan Monitor, ProjectDiscovery) and on request at the remaining 5, so budget time for quotes if your favourite is in that second group.
02
Weigh the vendor's home jurisdiction
Where a company is established decides which courts and regulators can reach it. Here that means 6 countries: North America 5, Europe 4, Elsewhere 2, Middle East 1.
Decide whether you need discovery or monitoring
Products in this category answer two different questions. Discovery tools such as Hadrian, CyCognito and Searchlight Exposure start from your organisation and work outward to find domains and subsidiaries you did not list. Monitoring tools such as Shodan Monitor and runZero watch the ranges you already know. Detectify and Intruder come from vulnerability scanning and add discovery on top.
A company that has acquired businesses or lets teams register their own domains needs discovery first. A company with one data centre and a short domain list may only need monitoring and alerts. Write down how many domains you can name today and how many you suspect exist, because that gap decides which type to shortlist.
How many domains and IP ranges can we list from memory?
Do subsidiaries or acquisitions register their own assets?
Do we need discovery, alerting or scanning of what we find?
Compare what each vendor counts and charges for
The billing unit differs, so quotes cannot be lined up directly. Attaxion counts billable domains, subdomains and IP addresses, and publishes tiers for 40, 120 and 360 assets. Detectify charges an annual platform fee, then extra per domain for Surface Monitoring. Shodan Monitor sells monitored IPs. CyCognito prices ASM on total assets and its testing services on active IPs and web applications, and Censys uses credits.
Hadrian quotes Atlas by asset count. Give every vendor the same inventory, ask them to list what is excluded, and request the price at double your current asset count so growth does not surprise you at renewal. Also ask whether scanning frequency, extra users or integrations change the price, because several vendors add these as separate lines once the first quote is accepted and the contract has been signed.
Which unit is billed: assets, domains, IPs, credits or users?
What is the price at twice our current asset count?
Which features sit above the entry tier?
Test attribution and false positives in a trial
Discovery tools differ most in how well they decide that an asset is yours. Run a trial with a domain list you already know, then check three things. First, whether every known asset appears. Second, whether unrelated assets are wrongly attributed to you, because those create work for your team. Third, whether the tool states why it linked an asset to your organisation.
Attaxion offers a 30-day trial and runZero a 21-day trial, while Hadrian offers a free external scan of a domain. Others, such as Tenable One Attack Surface Management and Recorded Future Attack Surface Intelligence, show their product through a demo. Ask each vendor to load your own domain for the demo rather than a sample.
Does the tool find the assets we already know?
Are wrongly attributed assets easy to remove?
Can the vendor explain why an asset is linked to us?
Check the vendor's ownership and exit terms
Ownership changes quickly in this market. Assetnote is now Searchlight Exposure after a 2025 acquisition, runZero joined Dragos in 2026, and Recorded Future belongs to Mastercard. After a takeover, support, pricing and roadmap can move. Ask what happens to your contract on a change of control, whether findings and inventory can be exported through an API or reports, and whether your data sits with the vendor after you leave.
Tools with APIs, such as Shodan Monitor and Attaxion, make exports easier to script. Request a written answer on data retention and deletion at contract end before signing, and check whether the vendor still sells the product under the same name, because product names can change after an acquisition, as the Assetnote name did.
Can the full inventory be exported through an API?
What happens to the contract after an acquisition?
How long does the vendor keep our data after exit?
What goes wrong most often when buying attack surface management software
Buying a vulnerability scanner and calling it attack surface management when it only scans assets you typed in.
Comparing quotes without a shared asset inventory, so each vendor prices a different attack surface.
Counting subdomains late: many tiers are sized by asset count, and subdomains multiply that count.
Skipping the ownership check on discovered assets, which leaves your team investigating domains that belong to someone else.
07
Frequently asked questions
7 answers
What is the best attack surface management software in 2026?
Our ranking of 12 puts Attaxion first. Attaxion counts domains, subdomains and IP addresses as billable and treats ports, certificates and technologies as context, which makes the bill predictable before you start.
Three tiers are listed with prices, plus a custom enterprise tier. The cost is in the limits: traffic monitoring, an isolated environment and wire payment sit only in the enterprise tier, and the post-trial free plan scans 40 assets monthly.
Which attack surface management tools publish their pricing?
The ones that do, with the model each states:
Attaxion: Published monthly or annual plans by asset count; 30-day trial, then a free plan.
Detectify: Published annual platform fees by tier; extra charges per domain and per scan target; trial available.
Intruder: Free plan; 14-day trial offered; Pro and Enterprise sold through sales.
runZero: Published starting price; free Community Edition up to 100 assets; 21-day trial.
Censys: Credit packages published for Platform use; Attack Surface Management quoted; free account.
Shodan Monitor: Published monthly API plans or one-time Membership; free account for the API.
Attaxion, Intruder, ProjectDiscovery have a free plan or free self-hosted edition.
Where are these attack surface management software vendors established?
Across 6 countries (North America 5, Europe 4, Elsewhere 2, Middle East 1):
Attaxion: Not stated by the vendor.
Detectify: Sweden.
Hadrian: Netherlands.
Searchlight Exposure: United Kingdom.
Intruder: United Kingdom.
CyCognito: Israel.
runZero: United States.
Censys: United States.
Shodan Monitor: Not stated by the vendor.
ProjectDiscovery: United States.
Recorded Future Attack Surface Intelligence: United States.
Tenable One Attack Surface Management: United States.
Which attack surface management tools can you host yourself?
ProjectDiscovery. The remaining 11 run only on the vendor's servers.
What should you use instead of Attaxion?
Detectify and Hadrian are the next two on this page. Detectify is for companies with a small set of web applications and APIs worth mapping and testing; Hadrian is for Firms wanting discovery and proof of exploitability from one Dutch vendor.
Who should not buy Attaxion?
Large estates needing wire payment, dedicated resources or traffic monitoring at list price. After the trial the free plan keeps only 40 assets and lets you view half of them, so it works as a taster rather than a working inventory..
Missing from this attack surface management software ranking? Contact us with a short description of the product and its users. Adding it is an editorial choice, and software advice explains what a listing does and does not involve.
