External Attack Surface Management or EASM solutions have become an integral part of the modern security tech stack. EASM solutions provide the essential visibility, context, automation, and scalability that organizations need to understand the entirety of their external attack surface and defend against advanced threats.
However, as with any tech, not all EASM solutions are created equal. Data quality, technical features, integration capabilities, service level agreements, and more can vary greatly from solution to solution, which is why finding a vendor that can truly meet your organization’s needs is imperative.
As you start your search for an EASM solution, you may find that referencing a vendor criteria checklist can help point your search in the right direction. By no means comprehensive, the abbreviated checklist below captures some of the essential categories you’ll want to inquire about during your vetting process. You can find a full list criteria in our EASM Vendor Evaluation Checklist.
Also read our Attack Surface Management 101 guide here.
Censys EASM Tool
EASM Vendors Criteria
I. General Qualifications
If a vendor doesn’t check the box on these core requirements, it may be your sign to keep searching.
Questions to consider:
- Can your external-facing assets, both known and unknown, including hosts, services, websites, and certificates, be discovered in real-time?
- Do you have to pay additional fees for more frequent scanning?
- Is the vendor an established solutions provider that serves enterprise customers across industries?
- Will you have access to a named Customer Success Manager and dedicated support with SLAs?
II. Data Depth & Accuracy
Data makes all the difference! Before going any further into discussions about an EASM solution’s bells and whistles, ensure that the data powering the solution can deliver a complete, accurate, up-to-date view of your attack surface.
Questions to consider:
- Does the vendor conduct comprehensive scans of the top 100+ ports?
- Does automatic protocol detection provide intelligent protocol awareness regardless of port assignment?
- Is extensive scanning conducted on IPv4, IPv6, and name-based hosts?
III. Asset Details
How much are you able to learn about assets and exposures on your attack surface? The right context is key to not only remediating existing exposures, but preventing similar security gaps in the future.
Questions to consider:
- Can you easily understand where your assets are hosted and see ownership information?
- Can you search thousands of indexed fields and see detailed information about service configuration and vulnerability?
- Can SSH, RDP, and end-of-life software can be investigated with intuitive queries?
IV. Dashboards and Reports
You should be able to acquire concise, actionable insights from user-friendly dashboards and reports.
Questions to consider:
- Is raw attack surface telemetry aggregated in an easy-to-understand dashboard, with trends and a view of your attack surface at-a-glance?
- Are hosts with critical risks and CVE priority identified by category or severity?
- Is it easy to identify expired certificates, including those that are currently expired or those that will expire in the coming week or month?
V. Risk Triage and Prioritization
Will your team be able to quickly understand and remediate truly critical risks? The last thing you want is time wasted on false positives or cloudy insights.
Questions to consider:
- Are zero-day risks quickly built into the solution and re-scans to validate that remediation efforts are working?
- Is precise context about discovered risks provided, along with recommendations for remediation?
VI. Operationalization and Integrations
You should be able to leverage attack surface data throughout your entire security ecosystem with native integrations and API endpoints.
Questions to consider:
- Can you integrate with your existing SIEM tools, with all necessary workflows supported?
- Does a full-featured API allow programmatic access and integration?
- Can you create distinct workspaces to support subsidiaries, mergers and acquisitions?
Get EASM Checklist
Investing in any new cybersecurity solution can be a big decision, but when you know what to look for, it’s one you make with confidence.
Find a complete list of criteria in the EASM Vendor Evaluation Checklist!
Request a Demo
