Attack surface management (ASM) tools discover your internet facing assets and watch them for change and risk. Open source options include OWASP Amass for discovery and Nuclei for template based checks. Commercial options include Microsoft Defender EASM, Censys and Rapid7 Exposure Command. Choose by how the tool finds assets and what happens after it does.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation, as of 19 October 2026.
Key takeaways
- ASM starts from seeds you already know, such as domains, and finds what connects to them.
- Discovery is only half the job. Fixing needs owners and tickets.
- Open source tools give control and cost time. Commercial tools add continuous monitoring and integrations.
- We could not find a source that ranks these tools, so we do not rank them.
What does an ASM tool do?
It builds an inventory of assets visible from the internet, then flags changes and weaknesses. Microsoft describes its discovery as recursively searching "through observed connections to known legitimate assets", starting from "discovery seeds". Censys says it "continuously measures your external attack surface from the outside in".
Which attack surface management tools are there?
| Tool | Type | How the vendor or project describes it |
|---|---|---|
| OWASP Amass | Open source, Apache 2.0 | "Network mapping of attack surfaces and external asset discovery" using open source intelligence; written in Go |
| Nuclei | Open source, MIT | Vulnerability scanner using YAML templates across HTTP, DNS, TCP, SSL and cloud configurations; meant mainly as a standalone CLI |
| Microsoft Defender EASM | Commercial, Azure service | Discovers domains, IP blocks, hosts, email contacts, ASNs and Whois organizations; dashboards for vulnerabilities, compliance and security hygiene |
| Censys | Commercial | First party scanning of "all 65K ports", drift detection with EPSS and KEV data, ticketing integrations; no prices on the page |
| Rapid7 Exposure Command | Commercial | InsightVM plus attack surface management in its Essentials tier; cloud and application security in Ultimate; no prices on the page |
Descriptions come from each page. We did not test any of them.
Which tool fits which team?
- A small team with engineering time: Amass for discovery and Nuclei for checks, wired into your own alerts.
- An Azure heavy organization: Defender EASM, which runs as an Azure resource.
- A team that wants outside in scanning with ticket routing: Censys or a similar service.
- A team already using Rapid7 scanning: Exposure Command adds the outside view to the same console.
How should I use the results?
Feed them into the same queue as your other findings. CISA's BOD 26-04 treats exposure as a core factor: an asset reachable by unauthenticated or untrusted parties on public networks counts as exposed, and removing an asset from the internet can extend its deadline. Reducing exposure is a legitimate fix.
How do I choose an ASM tool?
- How does it find assets, and can you give it your own seeds?
- Does it find shadow and forgotten assets, including cloud ones?
- How often does it rescan, and does it alert on change?
- Does it show KEV and EPSS data on findings?
- Can it map each asset to an owner?
- Does it create tickets in your tracker?
- Is scanning active or passive, and is that acceptable for your assets?
- What is the price at your domain and asset count?
Where does Safeguard fit?
Safeguard focuses on software supply chain risk, not outside in discovery of your domains. It offers reachability analysis, SBOM generation and import, and the Gold registry of packages and CVEs with CISA KEV status. Pair an ASM tool with dependency scanning, so you know which exposed services run vulnerable code.
Click through it at your own pace, or open it full screen.
Frequently asked questions
What is the difference between ASM and vulnerability management?
ASM finds what is exposed to the internet. Vulnerability management finds and tracks weaknesses in assets you already know about. They feed each other.
Is there a free ASM tool?
OWASP Amass and Nuclei are open source. Expect to build your own scheduling and alerting around them.
What are discovery seeds?
Seeds are assets you know belong to you, such as a root domain. Discovery starts there and follows connections.
Is it safe to run Nuclei against my systems?
Only scan systems you are authorized to test. The project also warns that running Nuclei as a service may pose security risks.
Sources
- OWASP Amass: https://owasp.org/www-project-amass/
- Nuclei: https://github.com/projectdiscovery/nuclei
- Microsoft Defender EASM overview: https://learn.microsoft.com/en-us/azure/external-attack-surface-management/overview
- Censys external exposure management: http://censys.com/solutions/external-exposure-management
- Rapid7 InsightVM and Exposure Command: https://www.rapid7.com/products/insightvm/
- CISA BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
Last reviewed: 19 October 2026.
