EASMLens
Concepts7 min read

How to Choose EASM Software: A 12-Point Buyer's Checklist

Most EASM products look alike in a demo: a world map, a count of assets and a list of findings. The differences that matter appear three months later, when you find out what it missed, what it got wrong and how much it costs as your estate grows. These twelve questions surface them before you sign.

Discovery: does it find what you did not tell it?

  1. What does it need to start? Good EASM starts from a handful of seeds, such as domains, IP ranges and company or brand names. If it only monitors the domains you list, it is a monitoring tool, not discovery.
  2. Which sources does it use? Ask by name: DNS, certificate transparency logs, internet-wide scan datasets, WHOIS and reverse lookups. Certificate transparency alone often reveals subdomains DNS enumeration misses.
  3. How does it decide an asset is yours? Attribution is where products differ most. Look for a confidence level on each asset and a way to confirm or reject suspected ones. A tool that presents every guess as fact will flood you with other people's assets.
  4. How often does it refresh? Daily or better for internet-facing estates. The Essential Eight expects online services to be scanned for missing patches at least daily.

Assessment: does it check what it finds, safely?

  1. Does it run active checks, or only list assets? Passive data shows what exists. Service detection and vulnerability checks show which assets an attacker could use. Ask exactly which tools run.
  2. How does it make sure it only scans what you own? A responsible platform requires proof, such as a DNS TXT record, before active checks. If anyone can point it at any domain, so can an attacker.
  3. Is it non-destructive? It should never attempt exploitation. If a vendor calls its EASM product a penetration test, ask what happens when a check goes wrong in production.
  4. Does it cover email and certificates? SPF, DKIM, DMARC, MTA-STS and DNSSEC on every domain, and certificate expiry on every host, catch problems vulnerability scanners ignore. So does checking for dangling DNS records.

Operations: will your team still read it in six months?

  1. Do findings stay stable between scans? If the same issue appears as new on every run, the report becomes noise. Ask for a demo of the change view: new, fixed and still open since the last scan.
  2. What can you export, and for whom? Auditors want PDF or Word. Engineers want CSV or tickets. Boards want a trend. Check the formats with a real report from a real estate.
  3. Where does your data go? Ask where scan data is stored and whether any AI features send it to a third-party AI service. For many buyers, a self-hosted model is a requirement, not a preference.
  4. How is it priced as you grow? Per asset, per domain, per IP or per organisation. Discovery often doubles the asset count you expected, so model the price at twice today's estimate.

Red flags

  • "Passive only" products sold as vulnerability management.
  • No way to mark an asset as not yours.
  • Claims that the product makes you compliant with a framework. No tool can.
  • Pricing that is only revealed after discovery has run on your estate.

Run a fair trial

Give every shortlisted vendor the same three or four seeds and two weeks. Before the trial, write down five assets you know exist but are hard to find, such as an old campaign site or a supplier-hosted portal. Compare who found them, how many false attributions each produced, and how understandable the findings were to the people who would fix them.

For background on the category, see EASM vs CAASM and standalone EASM vs platform add-ons. To see how EASMLens answers each question, start with the platform overview, or request a demo on your own seeds.

Other regions