Before you sign an attack surface management contract, ask how the vendor finds assets, proves they are yours, handles false positives, protects the access you give it, and returns your data when you leave. These questions turn a demo into evidence you can compare across vendors.
How should you use these questions?
Send them in writing and ask for written answers. Vague replies are answers too. Where a question says "show me", ask for a live demonstration on your own domains rather than a prepared environment.
Discovery and attribution
- What starting inputs do you need? Root domains only, or also IP ranges and cloud accounts?
- How do you decide an asset belongs to me? Ask for the evidence shown for three random findings.
- What happens with assets owned by a subsidiary, an acquired company or a shared host?
- How often is discovery re-run, and how quickly is a new asset visible?
- Which asset types are covered: domains, certificates, cloud services, APIs, exposed login pages, code repositories, mobile apps?
- What do you not cover? A straight answer here is a good sign.
Accuracy and noise
- What share of findings in a typical customer are false or misattributed? Ask how they measure it and whether you can sample your own.
- Can I suppress an accepted risk, with an expiry, and see the suppression history?
- How do you rank findings? Is the logic visible, and can I change it?
- Do you use exploitation data such as CISA's Known Exploited Vulnerabilities catalog or a scoring model like EPSS? FIRST states EPSS is not a complete risk score, so ask what else goes in.
Workflow and fit
- How does a finding reach its owner? Ticketing, chat, email, API?
- Can ownership be assigned by rule, for example by domain or cloud account tag?
- What changed, and when? Ask to see a history view for one asset.
- Can I export everything in an open format, and is the API covered by the contract?
- Which of my existing tools do you integrate with today, as opposed to on a roadmap?
Security, data and exit
- What access do you need from me, and can I limit it to read only? Ask about credentials for cloud accounts.
- Where is my data stored, who at the vendor can see it, and how long is it kept?
- What do you do with findings about my company? Some vendors aggregate data across customers. Ask whether that includes mine.
- What does exit look like: export format, deletion confirmation, and timing?
- What assurance can you share? Ask for current reports and read the scope. Do not accept a logo as an answer.
Commercial questions
How is the contract measured: by asset count, domains, seats or something else? What happens to the price if your asset count doubles after an acquisition? What is excluded from the base price, such as API access, extra integrations or support hours? Are there minimum terms and auto renewals? We are not quoting prices here, because they differ by vendor and change, but these structure questions affect cost more than the headline figure.
How to score answers
Give each question a score from 0 to 2: missing, partial, clear. Weight accuracy, attribution and exit more heavily than dashboards. A vendor that scores well on the demo but poorly on accuracy and exit is selling a screen. Keep the scoring sheet. It will help at renewal.
NIST's continuous monitoring guidance (SP 800-137) describes monitoring as providing visibility into assets and the effectiveness of controls. Use that as a test: does the product help you see assets and judge whether your controls work on them, or only list them?
Red flags
Refusal to demo on your domains. No explanation of attribution. A single risk score with no visible inputs. No export. An answer to every question that begins with "our AI".
Where Safeguard fits
Attack surface management as a category is vendor territory, and Safeguard does not replace it. We focus on the application and software supply chain side, including asset discovery with guardrails on what is discovered. When a vendor reports an exposed service, dependency and reachability data tells you whether its libraries are really exploitable.
What to do
- Send the questions in writing before the demo.
- Demo on your own domains and sample twenty findings.
- Score each answer 0 to 2 and keep the sheet.
- Weight attribution, accuracy and exit above dashboards.
- Ask for contract measures and what happens when your asset count grows.
- Test export before you sign.
Quick check
What is the single most useful question?
How do you prove an asset is mine? Attribution quality decides whether findings are worth reading.
Should I ask for prices in this list?
Ask how the contract is measured and what is excluded. Those terms drive the final cost more than the headline number.
Sources
Last reviewed: 18 October 2026.
