This guide is by the Bastion team, and Bastion appears in it — so we will state our bias up front and keep the framework honest: the right tool depends almost entirely on estate size and whether anyone at your company does security full-time. Capabilities and prices below are accurate to the best of our knowledge as of August 2026; confirm current details with each vendor. For background on the category itself, see What is EASM?
The comparison at a glance
| Tool | Type | Active scanning | Best for | Indicative price |
|---|---|---|---|---|
| Bastion | Passive monitor + change alerts | No (by design) | Small teams, agencies, MSPs | From $25/mo |
| Shodan Monitor | IP/port exposure alerts | No (uses crawl data) | Port-exposure tracking on a budget | From ~$69/mo tiers; cheap entry plans exist |
| Intruder | Vulnerability scanner + ASM | Yes | Teams needing CVE scanning for compliance | ~$100+/mo |
| Detectify | EASM + web-app scanner | Yes | Product security teams | Quote-based, typically $$$ |
| Censys ASM | Internet-scan-data ASM | Crawl-based | SOCs, threat intel, larger estates | Enterprise quotes |
| Microsoft Defender EASM | Enterprise EASM | Discovery-focused | Microsoft-centric enterprises | Per-asset metered |
| Free graders (SSL Labs, securityheaders.com, MXToolbox) | One-off single-purpose checks | No | Everyone, occasionally | Free |
Tier 1: Enterprise platforms
Microsoft Defender EASM, Cortex Xpanse, CyCognito and peers exist to solve discovery at scale: thousands of assets across acquisitions, shadow IT and forgotten business units. They infer ownership across the whole internet, which is impressive and expensive. If you can name every domain your company owns on one hand, you are not the customer, and the money is better spent elsewhere.
Tier 2: Security-team tools
Detectify pairs surface monitoring with a genuinely strong active web-app scanner fed by its ethical-hacker community — the right choice when exploitable application bugs are your main worry (full comparison). Intruder wraps established vulnerability-scanning engines in a clean product with compliance-friendly reporting — the right choice when an auditor requires CVE scanning (full comparison). Censys ASM builds inventory from internet-wide scan data and shines for threat-intel-driven teams (how search engines differ from monitors). All three assume someone will spend real hours in the tool every week.
Tier 3: Lightweight monitors
Shodan Monitor alerts on port exposure for IP ranges you register, using Shodan's crawl — excellent value for that specific slice, but blind to DNS, email authentication, headers and certificates-about-to-expire.
Bastion (that's us) covers the domain-shaped rest: TLS and certificate health, HTTP security headers, SPF/DMARC/CAA, subdomain discovery from certificate transparency logs, lookalike domains, registration expiry and common-port checks — passive only, permitted only on domains you have proven you own, scored 0–100, with change alerts and client-ready PDF reports from $25/month. It deliberately does not do CVE scanning or active testing.
Tier 4: Free one-off graders
Qualys SSL Labs, securityheaders.com, Mozilla Observatory, MXToolbox and Hardenize-style checkers are excellent, and you should use them — the catch is that each covers one dimension at one moment, on your initiative. They are the manual counterpart to continuous monitoring, not a substitute for it. We compared them in detail in Free website security scanners compared.
How to choose in three questions
- Do you administer servers whose patching you must verify? If yes, you need a vulnerability scanner (Intruder tier) somewhere in the stack.
- Can you list your entire estate from memory? If no — hundreds of assets, M&A history — you are shopping in the enterprise tier.
- Otherwise: your realistic risks are drift and misconfiguration. A lightweight continuous monitor plus occasional free graders covers you for tens of dollars a month.
Frequently asked questions
What is the best attack surface monitoring tool for a small business?
For most small businesses, a lightweight passive monitor is the right tier: it watches TLS certificates, DNS, email authentication, security headers and exposed ports continuously and alerts on change, at tens of dollars per month. Bastion (from $25/month) is built for exactly this; Shodan Monitor is a good complement if you also manage bare IP ranges. Enterprise EASM platforms solve an asset-discovery problem small businesses rarely have.
Do I need EASM if I already run a vulnerability scanner?
They cover different failures. A vulnerability scanner probes known assets for known software flaws; EASM discovers assets you did not know about and catches configuration drift — expiring certificates, weakened SPF, new subdomains, opened ports — that is not a CVE. Small estates can often skip the scanner; almost nobody should skip knowing what they expose.
Are free tools enough instead of a paid monitor?
Free graders like SSL Labs and securityheaders.com are high quality but manual and single-dimension: someone has to remember to run each of them, for every domain, and diff the results over time. That works until the week it doesn't. The thing you are paying a monitor for is that the checking — and the noticing — happens without anyone remembering.