Pricing for this category is unusually opaque: several leading vendors publish no numbers at all, and the ones that do use units that are hard to compare. What follows is the shape of the market as of August 2026, with the caveat that you should confirm current figures with each vendor before budgeting. We build one of these tools, so treat the Bastion figures as first-party and the rest as our reading of public pricing.
The four pricing models
| Model | Billed by | Typical range | Budget predictability |
|---|---|---|---|
| Per-asset metered | Discovered asset, per day | Scales with inventory size | Poor: discovery sets the bill |
| Per-domain / workspace tier | Domains or client workspaces | $25–$200 / month | Good: flat until you add domains |
| Per-target scanner license | Scanned hosts or applications | $100–$2,000 / month | Fair: you choose the target count |
| Quote-based enterprise | Negotiated, often per asset band | $15k–$150k+ / year | Fixed once signed, slow to buy |
Per-asset metered: the model that surprises people
Microsoft Defender EASM is the reference example, billed per discovered asset per day at a rate on the order of a US cent. The entry cost is genuinely low, and that is the trap: you are billed on what discovery finds, not on what you asked to monitor. An estate that turns out to have several thousand assets produces a bill in the hundreds to low thousands per month, and the number moves when someone spins up infrastructure.
This model suits organizations that want the true asset count and can absorb variance. It suits a small team on a fixed budget badly, because the first invoice is unknowable in advance.
Per-domain tiers: the small-team model
Lightweight continuous monitors price by domains monitored or by client workspace, in flat tiers. Bastion starts at $25/month, with higher tiers for more domains and a white-label MSP plan for agencies managing client estates. Shodan Monitor sits in a similar band for IP-range exposure specifically, and Shodan's cheap lifetime membership promotions have long made it an outlier on value for that narrow slice.
The tradeoff is scope: these tools deliberately do less. They watch TLS, DNS, email authentication, headers, subdomains and exposed ports on domains you have verified, and they do not do authenticated CVE scanning or active web application testing. For a team whose realistic risk is drift rather than an unpatched CVE on a server they administer, that is the right purchase.
Per-target scanner licensing
Intruder and comparable vulnerability scanners license by the number of targets you scan, typically starting around $100/month for a handful of hosts and climbing into four figures for larger target counts plus web application scanning. The pricing is transparent and the unit is one you control.
Worth knowing: if an auditor or customer questionnaire demands "vulnerability scanning," this is the tier that satisfies the wording. An external monitor does not, no matter how good its coverage of configuration risk, because the auditor is asking about CVEs on hosts. Which controls each one actually evidences is worth checking before you buy for compliance reasons.
Quote-based enterprise platforms
Detectify, Censys ASM, CyCognito and Palo Alto Cortex Xpanse publish no list prices. Public procurement records and customer reports put entry points in the low five figures annually, with large deployments well into six. Expect an annual contract, a sales cycle measured in weeks, and often a minimum asset commitment.
You are buying attribution at scale: the ability to point a platform at a company name and have it infer which internet assets belong to you across subsidiaries and acquisitions. That is a hard problem and the pricing reflects it. If you can list every domain your company owns from memory, you are paying for a capability you will not use.
The "free" option and what it actually costs
Open-source tooling covers a surprising amount of this ground: Amass and
Subfinder for subdomain discovery, nuclei for templated checks,
OpenVAS for CVE scanning, plus scripts around openssl and
dig. The software is free and genuinely good.
The cost is elsewhere. Someone has to host it, schedule it, keep feeds updated, store history, build alerting, tune out false positives, and notice when the cron job stopped running three weeks ago. At a loaded engineering cost of roughly $75 an hour, four hours a month of babysitting is $300, which exceeds most of the paid tiers on this page. That comparison is not an argument against self-hosting; it is an argument for doing it deliberately, with a named owner, rather than by default because the license is free. We worked through this tradeoff in detail in Bastion vs. OpenVAS.
Costs that are easy to miss
- Per-seat charges on top of asset pricing, which matter if you want developers to see findings.
- Report exports and API access gated to higher tiers, which bites when a customer questionnaire needs a PDF.
- Data retention limits. Audit evidence needs history; a tool that keeps 30 days cannot prove a control operated for a 12-month period.
- Onboarding or professional services fees on enterprise contracts.
- Annual-only billing at the enterprise tier, which is a cash-flow question as much as a cost one.
How to size the budget in practice
- Count your domains, not your assets. For most teams under fifty people this is between one and ten, which puts you squarely in the $25 to $200 per month band.
- Decide whether you need CVE scanning at all. If nobody at your company administers servers whose patch level you must attest to, you probably do not, and that removes the most expensive component.
- Budget for history, not just scanning. The retention window determines whether the tool can produce audit evidence later.
- Price the alternative honestly. Include the engineer hours, or you are comparing a real invoice against an imaginary zero.
Frequently asked questions
How much does external attack surface monitoring typically cost?
For a small team monitoring a handful of domains, $25 to $200 per month buys continuous passive monitoring with change alerts. Adding active vulnerability scanning moves you to roughly $100 to $2,000 per month depending on target count. Enterprise EASM platforms with automated asset attribution start in the low five figures annually and rise from there.
What is the price of Microsoft Defender EASM?
It is metered per discovered asset per day rather than sold in tiers, at a rate on the order of a US cent per asset. That makes the entry cost low and the total unpredictable, because your bill is set by however many assets discovery attributes to you. Check the current Azure pricing page for the exact rate, and model it against a realistic asset count before committing.
Is there a free attack surface management tool?
Yes, in parts. Amass and Subfinder handle subdomain discovery, nuclei runs templated checks, OpenVAS covers CVE scanning, and free graders like SSL Labs and securityheaders.com assess a single host on demand. Assembling and maintaining these into something that runs on a schedule and alerts you is the real cost, and a few hours of engineer time per month usually exceeds the price of a paid entry tier.
Why do so many vendors hide their pricing?
Quote-based pricing is standard where deal size varies enormously with estate size and where the vendor wants a sales conversation to scope asset counts first. It is a reasonable signal about fit: if a vendor will not publish a number, their entry point is usually well above what a small team budgets, and the sales cycle will be measured in weeks.