To trial an attack surface management tool in two weeks, write down what you already know about your assets, let the tool run, and score it on what it found that you missed, what it got wrong, and how usable the alerts are. Decide against criteria set before you start.
Before day one: set the rules
Pick one owner for the trial and a decision date. Agree the criteria in writing. A trial without criteria becomes a vote on the demo.
Authorize the scope. The tool should only probe assets and domains you own. Record the list of domains, cloud accounts and ranges you give it.
Build your answer key. Spend a few hours listing what you know: public domains and subdomains, known cloud accounts, a handful of services you consider internet facing. Also plant a few test items you control, such as a new subdomain with a harmless page, so you can time discovery.
Choose measures. We suggest six: known assets found, unknown assets found that were real, false positives, time to discover a planted asset, alert clarity, and effort to act.
Days 1 to 3: Connect and wait
Give the tool its seeds and connect read only access where it asks for cloud or DNS data. Note how much setup took and how much of it needed your time, because that predicts ongoing cost.
Resist adjusting anything yet. The first discovery pass shows how the tool performs with the least help.
Days 4 to 6: Check coverage
Compare findings against your answer key. For each known asset, did it appear, and was the owner or context right? For unknown assets, check each: is it ours, is it exposed, is it alive? A tool that reports a hundred unknowns of which five are real has a precision problem. CISA's BOD 23-01 asks agencies to run automated discovery every 7 days, so also note how often this tool re-checks and how fast it picks up change.
Score the planted asset. Create it on day 4 and note when the tool reports it.
Days 7 to 9: Judge the alerts
Pick ten alerts at random. For each, ask the questions an owner would ask: what is this, why does it matter, what do I do, who else needs to know. Rate each alert as actionable, vague or wrong. If the tool gives severity, check whether it reflects exposure and known exploitation. CISA's Known Exploited Vulnerabilities catalog is a handy public cross check on whether a flagged flaw is seen in the wild.
Assign a few alerts to real owners and watch whether they can act without help from you.
Days 10 to 12: Test the workflow
Try the daily path. Can you push an alert to your ticket system? Can you assign an owner, suppress a known accepted item with a reason and an expiry, and export results? Can a second person do it without training?
Ask the vendor three awkward questions and note the quality of answers. How do you handle assets that we share with a partner? How do you limit probing so it does not harm fragile systems? What do we keep if we leave?
Days 13 and 14: Decide
Score each criterion from 1 to 5 and add a short note with the evidence. Write down the cost drivers you learned, with quotes based on your own counts and not on list prices. Decide: buy, extend, or stop.
If you stop, thank the vendor and ask them to delete your data. If you buy, turn your answer key into a quarterly test.
What does a trial not show?
It will not show how a tool behaves over six months, how support responds on a bad day, or how pricing changes at renewal. Add those to the reference call list.
Where applications are concerned, an external tool sees the outside. Safeguard focuses on the application and software supply chain, including asset discovery with guardrails and reachability analysis, and does not replace an external attack surface tool.
What to do
- Write criteria, scope and a decision date before starting.
- Build an answer key and plant one test asset.
- Compare coverage and count false positives.
- Rate ten random alerts as actionable, vague or wrong.
- Test ticketing, suppression and export.
- Score, record evidence and decide on day 14.
Quick check
How many assets should my answer key have?
Enough to be meaningful but small enough to verify by hand, such as a few dozen known assets plus one or two planted test items.
Is it fine to let the vendor run the trial?
Let them help with setup but run the scoring yourself, using criteria you wrote before they showed anything.
Sources
Last reviewed: 18 October 2026.
