How to choose an attack surface management tool: a buyer checklist

Choose an attack surface management tool by running it on your own estate and checking what it finds that you did not already know. Judge coverage, accuracy, how findings reach an owner, and how you leave. A tool that cannot show new, correct assets in a trial is not worth the contract.

Start with a list you can test against

Before any demo, build a baseline: your known domains, cloud accounts, repositories and public services. Add five assets you suspect are forgotten, such as an old campaign site, a test environment or a domain bought for a product that was cancelled.

This list is your answer key. A tool that finds your known assets proves it works. A tool that finds your suspects proves it adds value. This guide does not rank vendors and names none.

What does it discover, and from where?

Discovery can start from different seeds: domain names, company names, IP ranges, cloud account credentials or code hosting accounts. Ask which seeds the tool needs and which it can work without.

Then ask how it grows the list. Following DNS records and certificates finds one kind of asset. Reading cloud APIs finds another. Neither finds code dependencies. CISA's Binding Operational Directive 23-01 treats asset discovery as non intrusive and usually needing no special access, and separates it from vulnerability enumeration. Use that split when a vendor blurs the two.

How accurate is it?

False ownership is the most common failure. A tool may attach an asset to your company because a shared hosting address appears in your records. During the trial, check a sample of 30 discovered assets by hand and record how many truly belong to you.

Also check staleness. Ask how often discovery runs, and how long a removed asset stays on the list. The same directive sets a 7 day cycle for automated discovery of federal assets, which is useful as a reference point for your own cadence, though it applies only to federal agencies.

How do findings reach the right person?

A finding with no owner is a report. Ask how the tool maps assets to teams: tags, cloud account owners, repository owners, directory data. Ask what happens when no owner is found.

Check the workflow end to end: finding, ticket, owner, fix, verification. If the only output is a dashboard, someone on your side will need to build the rest.

What does it say about risk?

Look at how it ranks. Severity alone is weak. Better tools combine exposure, exploit evidence and asset importance. Public references exist: CISA's Known Exploited Vulnerabilities catalog and FIRST's EPSS probability score are both openly available, so ask whether the tool uses them and shows its reasoning.

Ask what it validates. Detecting that a service is reachable differs from confirming a flaw is exploitable.

What about safety and scope?

Scanning other people's systems can cause harm or breach terms. Ask how the tool limits itself to assets you own, what traffic it generates, and how you can pause it. Find out whether it touches third party assets that appear in your records, and under what rules.

What are the commercial terms?

We are not giving prices. Ask what the price is based on (assets, domains, seats), how a newly discovered asset affects the bill, and what happens when discovery finds something unexpectedly large, like thousands of subdomains. Ask for data export in a usable format and for deletion terms at exit.

Scorecard

Score 0 to 3 on these rows, weighted before the demos:

1. Found our known assets.
2. Found assets we did not know, and they were ours.
3. Ownership accuracy on a hand checked sample.
4. Refresh cadence and removal handling.
5. Route to owner and ticketing.
6. Risk ranking that shows its inputs.
7. Scope controls and pause.
8. Export and exit terms.

What to do

1. Build the answer key list, including five suspected forgotten assets.
2. Shortlist on seed types and coverage, not on brand.
3. Run a trial of two weeks on your real estate.
4. Hand check 30 discovered assets for correct ownership.
5. Walk one finding all the way to a fixed ticket.
6. Negotiate export, deletion and pricing basis before signing.

Safeguard focuses on the application and software supply chain side and does not replace an external attack surface tool. It does offer asset discovery with guardrails on discovered assets, and reachability analysis for dependencies.

Quick check

Sources

• CISA BOD 23-01
• NIST glossary: attack surface
• CISA Known Exploited Vulnerabilities catalog
• FIRST EPSS

Last reviewed: 18 October 2026.