Choose an external attack surface management tool or service by testing six things on your own domains: attribution accuracy, discovery depth, noise control, workflow fit, data handling and exit terms. This guide gives criteria and a scoring method. It does not rank vendors, and no list can for you.
Is a tool or a service the right form?
A tool gives you a console and you do the triage. A service adds analysts who validate findings and tell you what matters. Choose a tool if you have staff to triage weekly. Choose a service if you do not, or if you want findings pre validated. Some products offer both tiers, so ask what each includes.
Criterion 1: attribution accuracy
The core question is whether a finding is really yours. Ask the vendor to show evidence for random findings: certificate details, registration data, hosting patterns, linked identifiers. In a trial, check twenty findings by hand and count wrong ones. High false attribution drains your team. Low recall hides assets.
Criterion 2: discovery depth and breadth
What does it cover: domains, subdomains, certificates, IP ranges, cloud services, exposed APIs, login pages, code repositories, mobile apps? How does it handle subsidiaries and acquisitions? Plant a few known obscure assets before the trial and see which are found. Ask what is not covered.
Criterion 3: change detection and timing
External surfaces change daily. Ask how often discovery runs, how a new asset is surfaced and how a change is described. Test with a harmless change in a sandbox account and time the detection.
Criterion 4: noise control and prioritization
Ask how findings are ranked and whether the logic is visible. CISA's Known Exploited Vulnerabilities catalog is a public list of vulnerabilities with observed exploitation, and CISA recommends using it as a prioritization input. FIRST describes EPSS as an estimate of exploitation probability in the next 30 days and says plainly it is not a complete risk score. A good product uses signals like these and adds your context, such as whether the asset holds sensitive data. Check that you can suppress accepted risks with an expiry date.
Criterion 5: workflow fit
Can findings reach owners through the ticketing and chat tools you use? Can ownership be set by rule? Is there an API covered by the contract? Can the evidence history show what was seen and what was done, dated? Ask for a demonstration with your tools.
Criterion 6: data handling and access
What access must you grant: read only cloud roles, DNS access? Where is your data stored, who can see it, and how long is it kept? Does the vendor combine data across customers? Ask for current assurance reports and read their scope.
Criterion 7: exit and portability
Can you export all findings and history in an open format? What deletion do you get on exit, and how is it confirmed? Test export before signing.
Criterion 8: commercial structure
How is it measured: assets, domains, seats or modules? How does the price change when you acquire a company? What is outside the base scope? Prices vary, and we do not quote any. Structure often affects total cost more than the headline.
How to score
Build a sheet with the eight criteria, a weight for each and a 0 to 2 score from your trial: missing, partial, clear. Weight attribution, noise and exit more than dashboards. Add notes of evidence, such as "checked 20 findings, 3 wrong". Have two people score independently and discuss differences.
NIST SP 800-137 describes continuous monitoring as visibility into assets and into control effectiveness. Use that as a final test: does the product help you act on what it sees?
Red flags
Refusal to run on your domains. No explanation of how assets are attributed. One opaque score. No export. Reliance on a reference customer you cannot contact.
What not to do
Do not pick on the size of the asset count. A larger number may mean more noise. Do not accept a prepared demo environment as proof. Do not skip your own ground truth.
Where Safeguard fits
EASM is not a Safeguard product and we do not claim to replace one. We focus on the application and software supply chain side. Whichever product you choose, dependency and reachability analysis helps you judge whether an exposed service's libraries are exploitable.
What to do
- Decide between tool and service by your triage capacity.
- Prepare ground truth and plant known assets.
- Test attribution on twenty findings.
- Time change detection.
- Check workflow, data handling and export.
- Score with weights and two reviewers.
- Ask about commercial structure, not just price.
Quick check
Can you give a ranked list of EASM vendors?
No. Fit depends on your estate and team, so we give criteria and a scoring method you can run on your own domains.
What is the first thing to test?
Attribution accuracy: hand check a sample of findings and count how many are not yours.
Sources
Last reviewed: 18 October 2026.
