Best Attack Surface Management Platforms in 2026 (Reviewed)

Attack surface management platforms help security teams find exposed assets before those assets become an entry point for an attacker.

However, the seven tools in this comparison solve different parts of the problem. Some focus on discovering forgotten systems, while others test whether a weakness can actually be exploited.

This guide compares seven attack surface management platforms by coverage, validation depth, buying model and suitability for different security teams.

It also explains how to separate useful exploit evidence from a growing queue of scanner findings.

Key Highlights (TL;DR)

• The Best Overall ASM Platform: Ethiack takes the top spot. It maps assets continuously, tests them when something changes, and attaches a reproducible proof of exploit to each finding.
• Why Do You Need It: Asset lists go stale faster than teams can update them, so unknown assets stay unmonitored. Attack surface management finds them and keeps watching.
• Who It’s For: Security leaders, AppSec teams and fast-growing companies that add new domains, cloud accounts or acquisitions.
• How to Choose the Right One: Check how thoroughly it discovers assets and how quickly it notices change. Then compare validation, integrations and pricing.
• Expected Price: Ethiack sells annual subscriptions priced by asset tier, plus on-demand pentests priced by credits. Across this list, pricing runs from free plans to annual fees starting at €15,000 for enterprise tiers, and most vendors quote on request.

Table of Contents

1. Top Attack Surface Management Platforms in 2026: at a Glance
2. What Are Attack Surface Management Platforms?
3. Why Do You Need Attack Surface Management Platforms?
4. Best Attack Surface Management Platforms: In-Depth Review & Comparison
5. How to Choose the Best Attack Surface Management Platform
6. Everything You Need to Know About ASM Platforms
7. Find the Right ASM Platform for Your Team
8. FAQs About Attack Surface Management Platforms

Top Attack Surface Management Platforms in 2026: at a Glance

Company	Best For	Key Features	Pricing
Ethiack	Security teams that want discovery plus proof of exploit	Continuous asset discovery, Hackian agentic testing, trigger-based tests, EU-only data	Annual subscription by asset tier or on-demand credits; quote required
Horizon3.ai (NodeZero)	Attack-path testing across external and internal estates	Asset discovery, autonomous exploitation, Quick Verify	From $15 per test; annual tiers from $50 per asset
Hadrian	European teams wanting external discovery with validation	Atlas exposure management, AI exploit checks, Nova pentests	Nova from €1,250 per test; Atlas by asset count
Intruder	Lean teams and cloud-native companies	Attack surface monitoring, cloud connectors, vulnerability checks	Free plan; Cloud $299 a month; Pro $499 a month; Enterprise custom
Outpost24	Teams that want managed EASM support	Continuous discovery, attack surface scoring, CyberFlex PTaaS	Custom quote through an enquiry form
Detectify	AppSec teams wanting hacker-written web testing	Surface Monitoring, Crowdsource modules, payload-based tests	Annual plans from €0 to €15,000+
XM Cyber	Large hybrid estates that rank exposure by attack path	Attack graphs, digital twin validation, EASM module	Quote only; Standard, Premium and Elite tiers

What Are Attack Surface Management Platforms?

Attack surface management platforms discover, inventory and monitor the assets an organisation exposes, so teams can reduce risk.

Gartner Peer Insights describes the external version as solutions that continuously find internet-facing assets from an attacker’s perspective.

The inventory comes first, because a vulnerability programme can only assess assets it already knows. Most products also track change, so a new subdomain raises an alert the day it appears.

Vendors take different routes to that goal, so this guide groups them by approach:

• Discovery with validation: Ethiack, Horizon3.ai and Hadrian test what discovery finds.
• Monitoring with vulnerability management: Intruder, Outpost24 and Detectify add ongoing checks.
• Attack-path exposure management: XM Cyber ranks exposures by the routes they open.

The reviews follow the same order.

Why Do You Need Attack Surface Management Platforms?

Most security teams know less about their external footprint than they think. IONIX reports that organisations are aware of roughly 62% of their actual external attack surface, based on its analysis of enterprise deployments.

Regulators add pressure as well. Frameworks such as NIS2 and DORA expect organisations to know which systems they run, and auditors now demand evidence of that knowledge.

Three situations create most of the gap:

• Fast releases: New subdomains, APIs and cloud instances appear faster than a manual asset list can record them.
• Acquisitions: A purchased company brings domains, hosting accounts and legacy systems the buyer never inventoried.
• Shadow IT: Teams launch services and test environments without telling security.

An ASM platform closes that gap by finding the assets and watching them continuously. The stronger ones also test whether a newly found asset can be exploited, which turns a long inventory into a short fix list.

Start-ups and small security teams feel the gap first, because a team that ships quickly adds new domains and cloud accounts faster than anyone documents them.

Best Attack Surface Management Platforms: In-Depth Review & Comparison

1. Ethiack

Overview

Ethiack is a Portuguese cybersecurity company whose attack surface management starts with continuous discovery and ends with proof. Its platform maps external, internal, cloud and third-party assets, including unknown subdomains, exposed APIs, forgotten cloud instances and shadow IT.

Hackian, the company’s agentic AI pentester, then tests what discovery finds and attaches a reproducible proof of exploit to every finding, so teams see which exposures an attacker could use.

Testing starts when a new asset appears or a system changes, so the inventory and the evidence stay current. Live reports for NIS2, DORA, ISO 27001, SOC 2 and PCI DSS draw on the same results.

Among attack surface management platforms, Ethiack suits buyers who want discovery and validation from one ASM vendor.

Best For

• CISOs who need to know which exposed assets an attacker could exploit
• Security teams with shadow IT, forgotten subdomains and exposed APIs
• Companies that grow through acquisitions and inherit unknown assets
• EU organisations that need discovery data kept inside the EU

Why It Stands Out?

Ethiack ties discovery to validation: assets found through ASM are tested by Hackian, and each result carries a reproducible proof of exploit. The company reports near-zero false positives and 90% noise elimination.

Testing starts on change, which Ethiack says shrinks the exposure window from weeks or months to hours or days.

All data stays in the EU, on servers in Belgium.

Pros

• Discovery includes overlooked subdomains, APIs and third-party exposure.
• Every finding includes a reproducible proof of exploit.
• Trigger-based testing keeps the asset inventory current.
• Data is processed only in the EU, which fits NIS2, DORA and GDPR buyers.

Cons

• Coverage starts external-first, and internal assets need an add-on beacon.
• Pricing isn’t published, so budgeting starts with a conversation.
• Teams that only want a passive asset inventory may not need validation depth.

Pricing

Ethiack doesn’t publish a price list. Continuous is an annual subscription priced by asset tier in packages of 50, and On-Demand is priced by pentest credits per engagement.

The company reports 50%+ savings where it replaces overlapping security products.

Buyers should request a scoped quotation based on their asset count.

2. Horizon3.ai (NodeZero)

Overview

Horizon3.ai’s NodeZero looks at the attack surface the way an attacker does: it starts with discovery and then attempts exploitation. The product finds public-facing, hybrid cloud and internal assets, which brings shadow IT into scope.

External tests launch from Horizon3.ai’s own cloud, and internal tests run from a customer-hosted Docker or virtual appliance. NodeZero also audits Active Directory passwords, measures phishing impact and runs rapid-response tests when a new threat appears.

Each finding includes an attack path and proof of exploit, and Quick Verify rechecks a fix once it has shipped.

NodeZero is closer to an attack-driven ASM platform than a pure inventory product, so it fits teams that care about what discovery leads to.

Best For

• Teams that want asset discovery tied to exploit evidence
• IT security teams testing external and internal exposure together
• Organisations that want self-service testing without booking consultants
• Buyers who prefer published per-asset pricing

Why It Stands Out?

Horizon3.ai is one of the smartest choices for teams that judge an attack surface by what an attacker can reach, as NodeZero follows each path from discovery to impact.

Reports name the exploits that ran and what they compromised, so teams can rerun tests after each fix to confirm the path is closed.

Rapid-response tests let teams check exposure to new threats as they emerge.

Pros

• Discovery and exploitation sit in one product.
• Reports show attack paths and successful exploitation.
• Quick Verify checks specific remediation efforts.
• Public per-asset pricing makes early budgeting easier.

Cons

• Internal testing needs a host or runner inside the target environment.
• The Flex tier counts an asset each time it’s tested, so frequent testing adds up.
• It focuses on attack paths, so teams wanting a broader inventory view may need another product.

Pricing

Horizon3.ai lists NodeZero per-asset prices in US dollars. Flex costs $15 per test, counted each time.

Core at $50, Pro at $65 and Elite at $85 are annual subscriptions with unlimited testing, counting each asset once a year.

Pro adds Tripwires and Rapid Response, and Elite adds exposure management.

3. Hadrian

Overview

Hadrian is an Amsterdam-based offensive security company, and Atlas is its continuous external attack surface product. Atlas discovers internet-facing assets, tracks changes in the exposed estate and uses AI agents to check which exposures can be exploited.

On the other hand, Nova – their agentic pen-testing product, adds on-demand tests against defined web applications and APIs. Because Atlas and Nova share asset context, a team can turn a newly found asset into a scoped test without starting again, while human experts validate findings alongside the AI agents.

As an ASM vendor, Hadrian is ideal for European teams seeking external discovery with validation behind it; across web applications, APIs and the wider external estate.

Best For

• Organisations with extensive internet-facing infrastructure
• Security teams managing exposure after acquisitions
• AppSec teams that commission deeper tests before major releases
• Buyers who want external discovery and on-demand AI pentesting together

Why It Stands Out?

Hadrian is one of the strongest choices for teams that want continuous external coverage with deeper testing on demand.

Atlas watches the exposed estate while Nova investigates specific applications.

Shared asset context cuts repeated scoping work, and human experts validate results.

Pros

• Atlas pairs external monitoring with AI-driven exploit checks.
• Nova adds targeted application tests for launches and audits.
• Shared asset context reduces scoping effort.
• The published Nova starting price helps early planning.

Cons

• The external-first focus may not cover every internal network objective.
• Atlas and Nova use separate pricing models.
• Deeper application testing may need extra Nova purchases.

Pricing

Hadrian prices Nova, its agentic pentesting product, from €1,250 per test before VAT, with bundles available. Reports map to SOC 2, ISO 27001 and NIS2.

Atlas, its continuous external exposure product, is priced by asset count, with add-ons for M&A and credential leaks.

Buyers will need to request a quote for custom pricing tailored to their estate.

4. Intruder

Overview

Intruder offers continuous vulnerability monitoring that helps teams spot internet-facing infrastructure exposures. Built around recurring scans, changing attack surfaces and actionable alerts, the product suits businesses without a large offensive-security function.

It finds infrastructure vulnerabilities, adds web application monitoring depending on plan and targets, and flags newly disclosed issues that affect the customer’s estate.

Overall, Intruder is a practical starting point for an organisation that needs to replace ad hoc manual scans with a more consistent process.

Best For

• Small and mid-sized teams without a dedicated security function
• Cloud-native companies that want assets imported automatically
• Teams that want discovery and vulnerability management in one product
• Buyers who value a free trial and published monthly pricing

Why It Stands Out?

Intruder is one of the smartest choices for lean teams that want continuous visibility without heavy setup. Discovery, vulnerability checks and cloud security share one view.

Integrations send findings to the tickets and channels teams already use.

Cloud security checks trace risks to a root cause, such as an IAM misconfiguration or an open bucket.

Plans start at no cost.

Pros

• Cloud connectors import assets without manual lists.
• Findings sync with Jira, Slack and Microsoft Teams.
• Whole-surface re-scans follow major new threats.
• A free plan and a 14-day trial lower the cost of trying it.

Cons

• Its focus is scanning, with no proof of exploit for each finding.
• Cloud and Pro prices cover five infrastructure targets, with extra charges beyond that.
• Continuous penetration testing is a separate add-on for Enterprise buyers.

Pricing

Intruder offers four plans: Free at $0, Cloud at $299 a month, Pro at $499 a month and Enterprise on custom pricing.

Cloud and Pro cover five infrastructure targets, with extra charges for more assets or web applications. A 14-day free trial is available, and annual billing saves 20%.

5. Outpost24

Overview

Outpost24 provides external attack surface management for organisations that need a reliable view of their internet-facing footprint. Its EASM offering discovers known and unknown assets, including domains, exposed services and infrastructure that may sit outside approved records.

Continuous monitoring detects changes and feeds exposure information into scoring and alert workflows. Outpost24 also offers managed assistance for teams needing help interpreting findings and coordinating remediation.

Its broader portfolio connects EASM to vulnerability management, application security testing and digital risk protection.

This gives enterprises room to combine asset visibility with adjacent security work.

Best For

• Teams that want a clear inventory of internet-facing assets
• Organisations that need managed EASM support
• Buyers who want discovery and human-led pentesting under one contract
• Companies monitoring brand risks such as lookalike domains

Why It Stands Out?

Outpost24 is one of the strongest choices for teams that want discovery backed by services. Attack surface scoring gives a single, clear measure to track over time.

Managed EASM and CyberFlex add expert help for teams that lack the capacity to run everything in-house.

Sweepatic’s technology is built into Outpost24’s wider exposure management platform, so findings sit alongside vulnerability data.

Pros

• Continuous discovery maps and monitors internet-facing assets.
• Attack surface scoring makes progress easy to report.
• Managed EASM adds expert support.
• CyberFlex adds human-led testing to discovery.

Cons

• Pricing is available only through an enquiry form.
• Validation of exploitability depends on the testing add-on.
• Managed options may be more than small teams need.

Pricing

Outpost24 doesn’t publish fixed pricing for its EASM offering. It builds customised packages around an organisation’s cybersecurity goals, team requirements and timelines.

Buyers will need to complete the pricing enquiry form on the website to receive a tailored proposal and quote.

6. Detectify

Overview

Detectify focuses on exposure across web applications and internet-facing services. Its Surface Monitoring product discovers domains and subdomains, watches for changing assets and detects issues such as potential subdomain takeover.

The company also offers application and API security scanning. Its testing draws on vulnerability research contributed by ethical hackers and uses payload-based checks against relevant technologies.

This can help AppSec teams narrow testing to weaknesses associated with their actual application stack.

Detectify is particularly suitable for organisations whose largest source of exposure comes from websites, APIs and fast-changing development environments.

Best For

• AppSec teams that want monitoring and web application testing together
• Product security teams that value crowdsourced hacker research
• Organisations with many domains and subdomains
• Teams that need SOC 2 and ISO 27001 reporting

Why It Stands Out?

Detectify’s research model contributes tests developed from the work of ethical hackers. Its payload-based approach checks application behaviour directly, so each finding rests on what the application does.

Surface Monitoring can also be paired with application and API scanning, so web security teams get a connected workflow.

The practical limitation is scope: network-wide internal attack-path analysis is a different buying requirement.

Pros

• Crowdsourced modules from 400+ ethical hackers feed the test library.
• Payload-based checks confirm what is exploitable.
• Monitoring, application and API testing share one dashboard.
• An MCP Server supports AI-driven workflows.

Cons

• Attack surface management features aren’t priced separately.
• Annual fees rise with assets, domains, environments and IP ranges.
• The strongest coverage is for web applications and APIs.

Pricing

Detectify’s annual platform fees start at €0 for Starter, €2,500 for Standard, €5,000 for Professional and €15,000 for Enterprise.

Surface Monitoring is charged separately by domain. Additional assets, application targets, API targets and environments can increase the total.

Its plan comparison also lists agentic tooling and an MCP Server.

7. XM Cyber

Overview

XM Cyber approaches exposure management through attack-path analysis. It connects security findings and asset relationships to show how combinations of weaknesses might allow an attacker to reach sensitive systems.

This matters in large organisations where an exposed asset is only one part of the risk: identity permissions, network connectivity and internal weaknesses may determine the eventual impact.

Its analysis helps teams prioritise remediation where a change could disrupt significant attack paths.

XM Cyber is therefore, an adjacent choice for attack surface management programmes that already have several sources of exposure data and need stronger correlation.

Best For

• Large organisations with hybrid and multi-cloud estates
• Security teams that prioritise exposure by routes to critical assets
• Teams that want validation without active testing in production
• Buyers who already run vulnerability management and need better ranking

Why It Stands Out?

XM Cyber is one of the strongest choices for ranking exposure across hybrid estates. Its attack graph shows where attack paths converge, so one fix at that choke point closes many routes.

Testing runs against a digital twin, so production systems stay untouched.

Remediation guidance covers exposures that can’t be patched, and workflow integrations route each fix to IT teams.

Pros

• Attack graphs show how exposures chain towards critical assets.
• Choke-point analysis shows where one fix removes several paths.
• A digital twin keeps production untouched during testing.
• The external module connects to internal attack paths.

Cons

• Validation runs against a model of the environment, not live systems.
• It isn’t positioned as a standalone agentic pentesting service.
• Pricing isn’t public and depends on the service tier.

Pricing

XM Cyber doesn’t publicly disclose pricing for its ASM platform, which centres on attack-path analysis and exposure validation.

It offers Standard, Premium and Elite service tiers with varying support levels.

Businesses must contact XM Cyber directly for customised pricing based on their estate and requirements.

How to Choose the Best Attack Surface Management Platform

A good attack surface management platform finds assets you did not know about, notices change quickly and shows which exposures matter.

These 7 factors work in order:

1. Start with the assets the tool can discover

Create a short inventory of the environments you want covered: domains, cloud accounts, APIs, remote offices, subsidiaries and third-party services.

Then ask each ASM vendor to identify assets missing from that list during a controlled trial.

A tool that only monitors known targets will not address a shadow IT problem.

2. Check how findings are confirmed

Ask the vendor to show two genuine findings from the evaluation. One should be a common misconfiguration and the other an application or identity exposure that requires several conditions.

Check whether the evidence proves reachability, exploitation or merely a possible issue.

The distinction affects the work your engineers do next.

3. Determine what triggers testing

Some attack surface management platforms scan on a timetable. Others react to newly discovered assets, infrastructure changes or threat intelligence.

Ask what happens after a new API is deployed, how soon testing begins and whether retesting follows remediation.

A monthly scan may still be suitable for a stable estate, but a daily release cycle creates different requirements.

4. Evaluate production safety and permissions

Active exploitation needs a clear scope. Review testing safeguards, rate limits, credential handling, third-party ownership checks and procedures for sensitive systems.

If you have internal networks or operational technology, clarify what needs an agent or appliance and which tests are disabled by default.

5. Follow a finding through to closure

A good demonstration should reach the remediation stage.

Ask which evidence a developer receives, whether an asset owner can be assigned and whether the finding can be retested after a fix.

Ticketing integrations are useful only if the results are sufficiently detailed to prevent repeated manual investigation.

6. Compare the total cost of coverage

An annual fee does not necessarily include every asset, application or testing run. Request a quote using your present scope and an estimated larger scope.

Include add-ons for managed support, internal testing, application scanning and acquisition assessments.

This will give procurement a fairer comparison than the entry price alone.

7. Check audit and data residency requirements

Ask where data is stored and processed, how long test evidence is retained and whether reporting supports your relevant standards.

An attack surface management vendor should provide clear contractual terms for authorised testing and access controls.

EU-regulated organisations may also need explicit assurance about data residency and subprocessors.

Everything You Need to Know About ASM Platforms

Company	Pros	Cons	Ease of Use	Integrations	Support	Affordability
Ethiack	Discovery plus proof of exploit; trigger-based testing; EU-only data	External-first coverage; internal assets need a beacon; no published pricing	⭐⭐⭐⭐⭐	⭐⭐⭐⭐	⭐⭐⭐⭐	⭐⭐⭐⭐
Horizon3.ai (NodeZero)	Discovery tied to exploitation; attack-path reports; per-asset pricing	Host needed for internal tests; Flex counts per test; narrower inventory view	⭐⭐⭐⭐	⭐⭐⭐⭐	⭐⭐⭐⭐	⭐⭐⭐
Hadrian	External discovery with AI exploit checks; shared context with Nova; certified	External focus; separate pricing models; extra Nova purchases	⭐⭐⭐⭐	⭐⭐⭐⭐	⭐⭐⭐⭐	⭐⭐⭐
Intruder	Cloud connectors; Jira and Slack sync; free plan and trial	Scanning focus; five-target limits; pentesting add-on	⭐⭐⭐⭐⭐	⭐⭐⭐⭐⭐	⭐⭐⭐⭐	⭐⭐⭐⭐⭐
Outpost24	Continuous discovery; attack surface scoring; managed EASM	Enquiry-form pricing; validation needs add-on; managed options may exceed small teams	⭐⭐⭐⭐	⭐⭐⭐⭐	⭐⭐⭐⭐⭐	⭐⭐⭐
Detectify	Crowdsourced research; payload checks; one dashboard	ASM not priced separately; fees rise with assets; web and API focus	⭐⭐⭐⭐	⭐⭐⭐	⭐⭐⭐	⭐⭐⭐⭐
XM Cyber	Attack graphs; choke points; digital twin testing	Modelled validation; not a standalone pentester; no public pricing	⭐⭐⭐	⭐⭐⭐⭐	⭐⭐⭐⭐	⭐⭐⭐

Find the Right ASM Platform for Your Team

The right ASM platform depends on which gap matters most.

Outpost24 and Intruder suit organisations that still lack a reliable inventory. Both build and monitor the external footprint, while the former adds managed support.

Teams with long lists of findings need proof of exploitability. Hadrian and Ethiack test the assets they discover to prove which exposures are real, and Horizon3.ai extends that work into internal attack paths.

For web-heavy estates, Detectify brings hacker-written application tests. Large hybrid environments get more from XM Cyber, which ranks exposures by the routes they open.

Whatever the use case or pain point, start with the problem costing your team the most, and choose the platform whose strengths match it.

FAQs About Attack Surface Management Platforms

What are the best attack surface management platforms?

The best attack surface management platforms in 2026 combine continuous discovery with proof that an exposure can be exploited, and Ethiack leads on that pairing. Hackian tests each asset it finds, and every finding carries a reproducible proof of exploit. Ethiack reports near-zero false positives and 90% noise elimination. Hadrian, Horizon3.ai and Intruder suit narrower needs, and pricing models differ, so compare quotes.

What should I consider when choosing the right ASM platform?

When choosing the right ASM platform, start with discovery depth, because unknown assets are the main risk. Next, check how quickly it notices change and whether it proves findings with evidence. Then compare cloud and third-party coverage, integrations and pricing model. Before signing, ask each vendor for a trial against your own domain list and a quote covering every module.

How does Ethiack differ from similar alternatives?

Ethiack differs from similar alternatives by testing every discovered asset with Hackian, its agentic pentester, so each result carries evidence. Testing starts when assets or systems change, and each finding includes a reproducible proof of exploit. All data stays in the EU, on servers in Belgium, with live compliance reports. Ethiack reports 90% noise elimination and 80% faster remediation, by its own measure.

How do I get started with Ethiack?

To get started with Ethiack, request a scoped quotation based on your asset count and choose a model: Continuous, an annual subscription priced by asset tier, or On-Demand, priced by pentest credits. Setup takes under 10 minutes with no installation, and on-demand pentests can launch in under 24 hours. Ethiack reports about 8 hours a week saved per security engineer once testing is running.

How easy is it to switch to Ethiack?

Switching to Ethiack is straightforward, since it adds discovery and proof of exploit on top of existing vulnerability management, so current investments stay in use. Setup takes under 10 minutes and deploys from the cloud. Integrations with Jira and Slack route validated findings to the teams that fix them, and Ethiack reports 50%+ savings when it replaces overlapping security products.

Does an ASM platform replace vulnerability scanners?

An ASM platform does not replace vulnerability scanners, because it finds the assets those scanners never knew about. A scanner assesses a known list, and an ASM platform builds and updates that list. Ethiack adds proof of exploit on top and reports 90% noise elimination, which cuts triage time for AppSec teams. Using both gives the full inventory and the proof.

What is attack surface management?

Attack surface management is the continuous process of discovering, inventorying and monitoring every asset an organisation exposes, then reducing the risk those assets carry. Gartner Peer Insights describes the external version as seeing assets from an attacker’s perspective. Ethiack applies it by mapping external, internal, cloud and third-party assets, then testing them with Hackian and attaching a proof of exploit.

What is the difference between ASM and EASM?

ASM covers every asset an organisation exposes, while EASM covers only the internet-facing ones. Many products start with the external view because attackers see it first, and programmes widen it later. Ethiack begins external-first and adds internal assets through an add-on beacon, so one ASM vendor can cover both views. That keeps the starting scope small and the upgrade path open.

How much do attack surface management platforms cost?

Attack surface management platforms cost anywhere from free plans to annual fees above €15,000. Intruder lists its Cloud plan at $299 a month, Detectify’s plans run from €0 to €15,000 or more a year, and Horizon3.ai lists $15 per test on its Flex tier. Ethiack sells by asset tier or pentest credits and reports 50%+ savings from replacing overlapping products. Ask for written quotes.

How often should surface management check for new assets?

Attack surface management should run for new assets continuously, because exposure changes whenever a team ships. Daily monitoring is the minimum for fast-moving estates, and trigger-based testing is better. Ethiack starts tests when a new asset appears or a system changes, and reports that this shrinks the exposure window from weeks or months to hours or days. Ask each vendor for its alert time.