# Attack surface management: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "attack surface management platform" and as "external attack surface monitoring tool", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/security/attack-surface-management

**Standing:** Intruder leads with 29% of first choices; verdict contested. 52 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Intruder](https://www.gane.ai/index/it/vendors/intruder/index.md) | 29% | 0% | 30 |
| 2 | [Attaxion](https://www.gane.ai/index/it/vendors/attaxion/index.md) | 19% | 5% | 20 |
| 3 | [CyCognito](https://www.gane.ai/index/it/vendors/cycognito/index.md) | 8% | 14% | 43 |
| 4 | [Microsoft Defender External Attack Surface Management](https://www.gane.ai/index/it/vendors/microsoft-defender-external-attack-surface-management/index.md) | 6% | 11% | 56 |
| 5 | [Censys ASM](https://www.gane.ai/index/it/vendors/censys-asm/index.md) | 6% | 20% | 30 |
| 6 | [UpGuard BreachSight](https://www.gane.ai/index/it/vendors/upguard-breachsight/index.md) | 4% | 9% | 22 |
| 9 | [Cortex Xpanse](https://www.gane.ai/index/it/vendors/cortex-xpanse/index.md) | 4% | 45% | 31 |
| 10 | [Tenable Attack Surface Management](https://www.gane.ai/index/it/vendors/tenable-attack-surface-management/index.md) | 2% | 18% | 22 |
| 11 | [CrowdStrike Falcon Exposure Management](https://www.gane.ai/index/it/vendors/crowdstrike-falcon-exposure-management/index.md) | 2% | 18% | 11 |
| 19 | [Detectify](https://www.gane.ai/index/it/vendors/detectify/index.md) | 0% | 9% | 11 |
| 26 | [Qualys External Attack Surface Management](https://www.gane.ai/index/it/vendors/qualys-external-attack-surface-management/index.md) | 0% | 30% | 10 |
| 104 | [Bitsight](https://www.gane.ai/index/it/vendors/bitsight/index.md) | 0% | 38% | 13 |

Rank is by share of first choices among all 114 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Intruder; alternatives CrowdStrike Falcon Surface, CyCognito, Microsoft Defender External Attack Surface Management, Tenable Attack Surface Management
- GPT-5.4 mini: Censys ASM; alternatives IONIX, Intruder, Microsoft Defender External Attack Surface Management
- Gemini 3.5 Flash: CyCognito; alternatives Censys ASM, Detectify, Microsoft Defender External Attack Surface Management, UpGuard BreachSight
- Perplexity Sonar: Intruder; alternatives Microsoft Defender External Attack Surface Management, UpGuard BreachSight
- Grok 4.20: Intruder; alternatives CrowdStrike Falcon Exposure Management, CyCognito, Microsoft Defender External Attack Surface Management
- Mistral Small: CyCognito, Intruder; alternatives Microsoft Defender External Attack Surface Management
- DeepSeek V4 Flash: UpGuard BreachSight; alternatives CyCognito, Intruder, Microsoft Defender External Attack Surface Management
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Tenable Vulnerability Management; alternatives Censys ASM, Dive, Rapid7
- Kimi K2: Intruder; alternatives CyCognito, Microsoft Defender External Attack Surface Management, SynScan
- GLM 4.7 FlashX: Intruder; alternatives CyCognito, SecurityScorecard
- MiniMax M2.5: Intruder; alternatives Attaxion, Halo Security
- GPT-6 Luna: Microsoft Defender External Attack Surface Management; alternatives Censys ASM, CyCognito
- Muse Glimmer 30B: Intruder; alternatives CyCognito, Microsoft Defender External Attack Surface Management

## Sources the answers cite

77 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- upguard.com: 38 answers, 62 citations
- cyble.com: 35 answers, 38 citations
- attaxion.com: 25 answers, 27 citations
- g2.com: 24 answers, 35 citations
- paloaltonetworks.com: 24 answers, 31 citations
- checkpoint.com: 19 answers, 20 citations
- circleid.com: 18 answers, 19 citations
- cycognito.com: 17 answers, 21 citations

Pages named in the most answers:

- https://cyble.com/knowledge-hub/top-attack-surface-management-services (34 answers)
- https://upguard.com/blog/attack-surface-management-vendors-compared (29 answers)
- https://attaxion.com/top-external-attack-surface-management-vendors (23 answers)
- https://circleid.com/posts/best-attack-surface-monitoring-tools (18 answers)
- https://checkpoint.com/cyber-hub/tools-vendors/best-attack-surface-management-platforms-2026 (17 answers)
- https://cybersectools.com/resources/shortlists/best-attack-surface-tools (15 answers)
- https://ordr.net/blog/best-attack-surface-management-platforms (15 answers)
- https://guideflow.com/blog/attack-surface-management-software (13 answers)
- https://synack.com/blog/best-attack-surface-management-tools (13 answers)
- https://upguard.com/blog/best-attack-surface-management-software-solutions (13 answers)

## Warned against

- Censys ASM: 6 of 30 labels negative. "Censys ASM is a platform that several sources explicitly advise caution about or even avoid for certain use cases" (Mistral Small, negative prompt)
- Cortex Xpanse: 14 of 31 labels negative. "What to Avoid ... Enterprise-focused; ~$95,000/year starting price" (Kimi K2, paraphrase prompt)
- CyCognito: 6 of 43 labels negative. "Users report high false positive rates, slow support, lack of step-by-step remediation guidance, and pricing that's prohibitive for SMBs" (DeepSeek V4 Flash, negative prompt)
- Microsoft Defender External Attack Surface Management: 6 of 56 labels negative. "Better suited for organizations heavily invested in Microsoft stack" (Kimi K2, paraphrase prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Intruder at 29%.

- Intruder: 49% to 29%, −20. Cleared the floor by 9 points · rank 1 of 114, unchanged.
- Censys ASM: 0% to 6%, +6. Inside the floor by 5 points · rank 89 → 5 of 114.
- Attaxion: 14% to 19%, +5. Inside the floor by 6 points · rank 2 of 114, unchanged.
- Microsoft Defender External Attack Surface Management: 10% to 6%, −4. Inside the floor by 7 points · rank 3 → 4 of 114.
- Cortex Xpanse: 0% to 4%, +4. Inside the floor by 7 points · rank 23 → 9 of 114.
- Detectify: 4% to 0%, −4. Inside the floor by 7 points · rank 6 → 19 of 114.
- CyCognito: 6% to 8%, +2. Inside the floor by 9 points · rank 4 → 3 of 114.
- UpGuard BreachSight: 6% to 4%, −2. Inside the floor by 9 points · rank 5 → 6 of 114.
- CrowdStrike Falcon Exposure Management: 0% to 2%, +2. Inside the floor by 9 points · rank 18 → 11 of 114.
- CrowdStrike Falcon Surface: 2% to 0%, −2. Inside the floor by 9 points · rank 8 → 50 of 114.
- Tenable Attack Surface Management: 2% to 2%, ±0. Inside the floor by 11 points · rank 7 → 10 of 114.
- Wiz: 0% to 0%, ±0. Inside the floor by 11 points · rank 17 → 20 of 114.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.