Ask an ASPM vendor where its findings come from, how it removes duplicates, which exploit signals it uses to rank them, how it finds the owner of each issue, and how it proves a fix landed. ASPM has no standard definition, so every claim needs a live test on your data.
Application security posture management tools sit above scanners and try to turn many alert streams into one prioritized list. That is a sensible goal. It is also a category where a pitch deck can say a great deal and the product can do a narrow slice of it. These questions separate the two.
Where does the data come from?
An ASPM tool is only as good as its inputs.
- Which scanners does it ingest, and which does it run itself? Ask for the connector list for your actual stack, not a logo wall.
- How does it ingest? Native API, file import, or a generic webhook? Ask how often it refreshes and what happens when a source fails silently.
- Does it accept SBOMs and VEX? CISA describes an SBOM as a nested inventory of software components and VEX as an attestation that a product is or is not affected by a vulnerability. If the tool cannot read or write them, you will rebuild that evidence by hand.
How does it deduplicate and group findings?
Three scanners reporting the same flaw is one problem, not three.
- Ask for a demo with one known vulnerable dependency reported by two tools. Count the results.
- Ask what the tool treats as identity: package URL plus version, file and line, CVE ID? Weak identity creates ghosts after a rescan.
- Ask what happens to a suppressed finding when the tool re-imports it.
What signals does it use to rank?
Severity alone is a poor sorting key. Ask which of these it uses, and where each comes from.
- Known exploitation. CISA's KEV catalog lists CVEs with evidence of exploitation in the wild.
- Exploit probability. FIRST describes EPSS as a daily probability of exploitation within 30 days.
- Reachability, meaning whether your code can actually call the vulnerable path.
- Exposure and environment. CISA's BOD 26-04 uses public exposure, KEV status, exploit automation and technical impact to set urgency for US federal agencies. It does not bind private companies, but it is a useful sanity check on any ranking model.
Then ask the awkward question: can I see why this finding is number one? A score with no explanation is hard to defend to an engineer.
How does it find the owner?
Prioritization without ownership produces a nicer list that nobody acts on. Ask how the tool maps a finding to a team: CODEOWNERS, repository metadata, a service catalog, manual rules. Ask what it does when the owner is unknown, and whether it can open a ticket in the tracker your engineers already use.
How does it close the loop?
- Can it open a fix pull request, and who reviews it?
- Does it notice when the fix merges and mark the finding resolved, or does it wait for the next scan?
- Can it report time from detection to fix by team?
- Can it record an exception with an approver and an expiry date?
What about data, models and lock-in?
Ask what leaves your environment. Ask whether any language model sits in the path, which provider it is, and whether you can turn it off or use your own. Ask for a full export of findings, decisions and exceptions in an open format, and get that right into the contract. Without it you are renting your own history.
What are the limits of ASPM?
An ASPM layer cannot fix a scanner that misses things. It cannot know your business context unless you tell it. And a unified list can hide the difference between a scanner that found nothing and a scanner that failed to run. Ask how the tool shows coverage gaps, and treat a clean dashboard with suspicion until you know that.
What to do
- Write your top five pain points, such as duplicate alerts or no owner, and tie each to a question above.
- Give two vendors the same export from your scanners and compare dedup results.
- Ask each to explain the top ten findings in plain words.
- Test the ticket and pull request path with one real finding.
- Request the export format and a sample file before signing.
- Ask for feature maturity in writing: generally available, early access or roadmap.
Quick check
Is there a standard definition of ASPM?
We did not find a standards body definition, so treat the term as a marketing category. Define the capabilities you need and test each one.
What is the most useful single test in an ASPM trial?
Feed in the same vulnerability from two scanners and see whether it shows up once or twice, then ask the tool to explain the ranking of your top ten.
Sources
- CISA, Software Bill of Materials (SBOM) and VEX
- CISA, Known Exploited Vulnerabilities Catalog
- CISA, BOD 26-04: Prioritizing Security Updates Based on Risk
- FIRST, Exploit Prediction Scoring System
Last reviewed: 18 October 2026.
