What drives the cost of external attack surface management?

External attack surface management (EASM) cost depends on a few drivers: how many assets and domains you have, how often they are checked, which integrations you need, and how much staff time goes into acting on findings. Build a budget from vendor quotes and these drivers, not from price figures found online.

What is EASM?

EASM discovers and monitors the internet facing parts of your estate as an outsider would see them: domains, subdomains, IP addresses, certificates, cloud services and exposed applications. The aim is to find what you did not know about and what is misconfigured. We give no prices here. Pricing changes often and varies by customer, so use written quotes.

Vendor side cost drivers

Asset count. Many offerings scale with the number of domains, hosts or IP ranges. A company with many acquired brands or a large cloud footprint pays more than one with a single domain. Ask how an asset is defined: a hostname, an address or a service?

Discovery depth and frequency. Continuous discovery costs more than monthly scans. Ask what "continuous" means in hours, and whether deeper checks cost extra.

Modules. Some bundles add certificate monitoring, brand and typo domain monitoring, exposed credential checks or testing of discovered web applications. Each may be priced separately. List which you need.

Integrations and API access. Pushing findings into your ticket system and log tool may require a higher tier.

Data retention and history. Longer history for trend reporting can raise the price.

Support and services. Onboarding, tuning help or a managed review.

Contract shape. Term length, minimum commitments, renewal increases and overage charges.

Your side cost drivers

These are often larger than the license.

Triage time. Someone must read findings, sort real from noise and route them. A constructed estimate approach: count findings from a trial month, multiply by minutes per finding, convert to hours.

Remediation work. Fixing exposed services is engineering time. If your discovery finds a hundred forgotten systems, you must decide who removes them.

Process setup. Defining ownership, severity rules and a removal policy.

Tool integration. Connecting to cloud accounts, DNS and your asset register.

How to build a budget without guessing

1. Count your starting assets: domains, known IP ranges, cloud accounts, brands.
2. Request quotes from three providers using the same asset counts and module list.
3. Ask each quote to show the formula, and what happens if your count doubles.
4. Run a trial and measure triage hours and findings per week.
5. Add staff time at your internal rate for triage and fixing.
6. Add a contingency line for growth, such as an acquisition.

Present the result as a range with the assumptions named, not a single number.

Can you do some of it for free?

Partly. Certificate transparency logs, DNS zone exports from your own registrar, cloud inventory APIs and your own repositories reveal a lot of what you own. Public sources such as CISA's Known Exploited Vulnerabilities catalog help you prioritize what you find. A paid tool is justified when your discovery gap is large and manual work does not keep up, such as with many acquired companies.

Questions that expose hidden costs

• What happens to the price if we add subsidiaries?
• Are scan targets capped, and what is the overage rate?
• Is API access included?
• What does exit cost, including data export?

A scope note

EASM watches the outside view. Safeguard focuses on the application and software supply chain side and does not replace an EASM product. It does provide asset discovery with guardrails on discovered assets, which complements an outside in view rather than substituting for it.

A constructed budget walk through

Imagine a company with two brands, 40 known domains and three cloud accounts. It requests quotes on that basis and adds a contingency for one acquisition. During a one month trial the tool surfaces 60 findings. Staff spend about ten minutes triaging each, so ten hours in the month, and eight of the findings need engineering work averaging half a day each. The budget then has four lines: the quoted subscription, triage time, remediation time and a growth reserve.

All numbers in that example are invented to show the method. Replace each with your own count. The useful habit is writing the assumption beside each line, so that when the asset count doubles after an acquisition, the finance team can see exactly which line moves and why. It also helps in renewal talks, because you can compare actual usage with the quote's assumptions and push back on increases that do not match.

What to do

1. Write down your asset counts and the modules you actually need.
2. Get three written quotes on the same basis.
3. Run a trial and record triage hours.
4. Add internal staff time to the budget.
5. Negotiate caps on renewal increases and export rights.

Quick check

Sources

• CISA Known Exploited Vulnerabilities Catalog

No vendor price lists were consulted. Cost drivers reflect general procurement practice.

Last reviewed: 18 October 2026.