IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index Security operations ASM › Enterprise September 2026 Edition

Attack surface management for enterprise buyers

Asked as “attack surface management platform”, and as “external attack surface monitoring tool”, on behalf of an enterprise B2B company. 43 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Contested
21% of first choices, contested.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Bitsight21%4%25accepted challenger
03Cortex Xpanse16%19%43accepted challenger
04CyCognito9%21%38accepted challenger
05CrowdStrike Falcon Exposure Management5%8%12accepted challenger
06CrowdStrike Falcon Surface5%26%19criticized challenger
07IONIX2%0%13accepted challenger
08Wiz2%17%12accepted challenger
Show the four products at 0%, ordered by negative rate
12Censys ASM0%39%28criticized challenger
10Tenable Attack Surface Management0%17%18accepted challenger
11IBM Randori0%9%11accepted challenger
09Synack0%0%20accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11
12
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01Bitsight21%
02Microsoft Defender External Attack Surface Management19%
03Cortex Xpanse16%
04CyCognito9%
05CrowdStrike Falcon Exposure Management5%
06CrowdStrike Falcon Surface5%
07IONIX2%
08Wiz2%
09Synack0%
10Tenable Attack Surface Management0%
11IBM Randori0%
12Censys ASM0%

02What they warned about

Three of twelve models held their first choice under the paraphrase. GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Censys ASM
39%
11 of 28 labels negative · 8 of 12 models
“Tools that do not validate the exploitability of discovered vulnerabilities (e.g., Censys as a standalone) may overwhelm security teams with false positives” Mistral Small, negative prompt
Cortex Xpanse
19%
8 of 43 labels negative · 7 of 12 models
“Platforms tightly integrated with a single vendor's ecosystem (e.g., Cortex Xpanse, Defender EASM, Falcon Surface, Tenable ASM) may not be suitable” Mistral Small, negative prompt
Microsoft Defender External Attack Surface Management
18%
7 of 39 labels negative · 6 of 12 models · 2 hard negative
“❌ Poor — invoice scales with discovery, which grows unboundedly” DeepSeek V4 Flash, budget prompt
CyCognito
21%
8 of 38 labels negative · 6 of 12 models · 1 hard negative
“Avoid: Pure per-asset metered plans from vendors like **CyCognito** or **Tenable**” Qwen 3.7 Flash, budget prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

68 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 942 links across 230 sites, every framing counted. Ranked by the number of answers carrying the site or page.

vendor site · UpGuard48 answers · 52 citations · 10 models
vendor site · Bitsight41 answers · 52 citations · 10 models
vendor site · Synack40 answers · 44 citations · 10 models
32 answers · 48 citations · 10 models
vendor site · Palo Alto Networks26 answers · 40 citations · 9 models
vendor site · IONIX25 answers · 34 citations · 9 models
vendor site · Wiz22 answers · 32 citations · 9 models
vendor site · CyCognito20 answers · 24 citations · 8 models
20 answers · 20 citations · 8 models
vendor site · Guideflow18 answers · 18 citations · 10 models
17 answers · 17 citations · 10 models
14 answers · 14 citations · 7 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best attack surface management platform for an enterprise B2B company?”Paraphrase“Which external attack surface monitoring tool would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade attack surface management platforms and how do they differ?”Budget-constrained“What is the best attack surface management platform for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating an attack surface management platform. What should we look at?”Negative“Which attack surface management platforms should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5Bitsight
Four alternativesCortex Xpanse, CrowdStrike Falcon Surface, Microsoft Defender External Attack Surface Management, Synack
BitsightHeld
Three alternativesCyCognito, Qualys External Attack Surface Management, Tenable Attack Surface Management
Bitsight
Three alternativesCortex Xpanse, CyCognito, Wiz Attack Surface Management
Microsoft Defender
Three alternativesBitsight, Cortex Xpanse, Tenable Attack Surface Management
no first choiceagainst: Mandiant Attack Surface Management
GPT-5.4 miniMicrosoft Defender External Attack Surface Management
Two alternativesCortex Xpanse, CrowdStrike Falcon Surface / Exposure Management
CrowdStrike Falcon Surface, Tenable OneChanged
One alternativeRapid7 Surface Command
Cortex Xpanse
Two alternativesMicrosoft Defender External Attack Surface Management, Tenable Attack Surface Management
Mandiant Attack Surface Management
One alternativeObsonis Enterprise
against: Attaxion, Microsoft Defender External Attack Surface Management
no first choiceagainst: CrowdStrike Falcon Security and IT Operations, Pentera, Qualys, RedHunt Labs ASM Platform
Gemini 3.5 FlashWiz
Six alternativesCrowdStrike Falcon Exposure Management, CyCognito, IONIX, Microsoft Defender External Attack Surface Management, Palo Alto Networks, Synack
CyCognito, IONIXChanged
Four alternativesCortex Xpanse, CrowdStrike Falcon Surface, Tenable Attack Surface Management, Wiz
Cortex Xpanse, CrowdStrike Falcon Surface, Microsoft Defender External Attack Surface Management
Five alternativesCensys ASM, CyCognito, IBM Randori, IONIX, Synack
runZero
Three alternativesCensys ASM, Cortex Xpanse, CyCognito
against: Microsoft Defender External Attack Surface Management, Nudge Security
no first choiceagainst: Censys ASM, Cortex Xpanse, CyCognito, Microsoft Defender External Attack Surface Management, Shodan-style aggregators, Tenable Attack Surface Management
Perplexity SonarBitsight
Three alternativesCyCognito, Synack, Wiz
Cortex XpanseChanged
Four alternativesBitsight, Censys ASM, Microsoft Defender External Attack Surface Management, Tenable Attack Surface Management
Palo Alto Networks Cortex Xpanse / Cortex Exposure Management
Six alternativesCensys ASM, CrowdStrike Falcon Surface / Exposure Management, CyCognito, Microsoft Defender External Attack Surface Management, Tenable Attack Surface Management, Tenable One
against: Wiz
Microsoft Defender External Attack Surface Management
One alternativeCortex Xpanse
no first choiceagainst: Attaxion, Bishop Fox Cosmos, Censys ASM, Cortex Xpanse, CrowdStrike Falcon Exposure Management, CrowdStrike Falcon Surface, Detectify, Intruder, Microsoft Defender External Attack Surface Management, Tenable ASM / Tenable One, UpGuard BreachSight
Grok 4.1 FastCrowdStrike Falcon Exposure Management
Two alternativesCortex Xpanse, Rapid7 Exposure Command
CyCognitoChanged
Four alternativesBitsight, Cortex Xpanse, CrowdStrike Falcon Exposure Management, IONIX
Cortex Xpanse
Five alternativesCrowdStrike Falcon Exposure Management, CyCognito, IONIX, Microsoft Defender External Attack Surface Management, Synack
against: IBM Randori
Microsoft Defender External Attack Surface Management
Two alternativesCrowdStrike Falcon Surface, Qualys External Attack Surface Management
against: CyCognito, Detectify, Mandiant Attack Surface Management, Tenable
CrowdStrike Falcon Exposure Management, CyCognito
Six alternativesCensys ASM, Detectify, IBM Randori, IONIX, Mandiant Attack Surface Management, UpGuard BreachSight
against: Armis, Censys ASM, CyCognito, Microsoft Purview, Rapid7 InsightVM
Mistral SmallBitsight
Two alternativesIntruder, Synack
Bitsight, Cortex XpanseChanged
One alternativeAssetnote
Synack
Six alternativesCortex Xpanse, CrowdStrike Falcon Surface, CyCognito, IONIX, Microsoft Defender External Attack Surface Management, Tenable Attack Surface Management
against: Censys ASM
Microsoft Defender External Attack Surface Managementno first choiceagainst: Censys ASM, Cortex Xpanse, CrowdStrike Falcon Surface, Microsoft Defender External Attack Surface Management, Tenable Attack Surface Management
DeepSeek V4 FlashBitsight
Six alternativesCortex Xpanse, CrowdStrike Falcon Surface, Microsoft Defender External Attack Surface Management, Qualys External Attack Surface Management, Synack, Tenable Attack Surface Management
CyCognitoChanged
Three alternativesBitsight, Cortex Xpanse, Microsoft Defender External Attack Surface Management
Cortex Xpanse, CyCognito
Six alternativesCensys ASM, CrowdStrike Falcon Exposure Management, IBM Randori, Microsoft Defender External Attack Surface Management, Qualys CyberSecurity Asset Management, Tenable One / Tenable ASM
Mandiant Attack Surface Managementagainst: CTM360, Censys ASM, Cortex Xpanse, CyCognito, Microsoft Defender External Attack Surface Management, Shockwaveno first choiceagainst: Censys ASM, Orca Security
Llama 4 MaverickBitsight
Three alternativesCensys ASM, Synack, UpGuard BreachSight
CrowdStrike Falcon Surface, ExternalSight, Ivanti Neurons for EASMChangedno first choiceno first choiceno first choicenothing named
Qwen 3.7 FlashBitsight
Three alternativesCrowdStrike Falcon Exposure Management, CyCognito, UpGuard BreachSight
Cortex XpanseChanged
Three alternativesCyCognito, Microsoft Defender External Attack Surface Management, Wiz
CyCognito
Four alternativesBitsight, Cortex Xpanse, CrowdStrike Falcon Surface, Mandiant Attack Surface Management
FullHunt ASM, Trickest ASM
Two alternativesMicrosoft Defender External Attack Surface Management, UpGuard BreachSight
against: Cortex Xpanse, CyCognito, Tenable, Wiz
no first choicenothing named
Kimi K2Cortex Xpanse
Four alternativesCrowdStrike Falcon Exposure Management, Microsoft Defender External Attack Surface Management, Rapid7 Exposure Command, Tenable One
Cortex XpanseHeld
Two alternativesCyCognito, IBM Randori
no first choiceagainst: Censys ASM, CyCognitoMicrosoft Defender External Attack Surface Management
Two alternativesFullHunt Enterprise, Tenable One
against: Cortex Xpanse, CrowdStrike Falcon Surface, CyCognito
no first choiceagainst: Censys ASM, Cortex Xpanse, CrowdStrike Falcon Surface, Microsoft Defender External Attack Surface Management
GLM 4.7 FlashXCortex Xpanse
Five alternativesCyCognito, Microsoft Defender External Attack Surface Management, Synack, Tenable Attack Surface Management, Wiz
against: Censys ASM, Detectify, Intruder, VeilScan
Cortex XpanseHeld
Three alternativesMicrosoft Defender External Attack Surface Management, Tenable One, Wiz
Synack
Six alternativesCensys ASM, Cortex Xpanse, CyCognito, Qualys External Attack Surface Management, Tenable Attack Surface Management, Wiz
Microsoft Defender External Attack Surface Managementagainst: CrowdStrike Falcon Surface, CyCognito, Tenable Attack Surface Managementno first choiceagainst: Bitsight, Cortex Xpanse, JupiterOne, ReliaQuest GreyMatter
MiniMax M2.5Bitsight
Three alternativesCortex Xpanse, SecPod SanerNow, Synack
Microsoft Defender External Attack Surface ManagementChanged
Five alternativesBitsight, Censys ASM, Qualys External Attack Surface Management, SecurityScorecard, Tenable Attack Surface Management
CyCognito, Synack
Three alternativesBitsight, Cortex Xpanse, Microsoft Defender External Attack Surface Management
against: Censys ASM
Microsoft Defender External Attack Surface Management
Four alternativesCortex Xpanse, CrowdStrike Falcon Surface, CyCognito, Mandiant Attack Surface Management
no first choicenothing named
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:40yes98 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:05yes46 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:22yes1428 s
Direct recommendationPerplexity Sonarsonar2026-09-17 11:01yes206 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:33yes3522 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 12:19yes54 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 09:22yes911 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 10:10yes52 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:54yes934 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:12yes1734 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:58yes2784 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:26yes516 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 09:41yes98 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:28yes35 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 10:53yes1427 s
ParaphrasePerplexity Sonarsonar2026-09-17 10:35yes205 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 14:06yes2116 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 13:54yes55 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-09-17 13:46yes2549 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 14:02yes105 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:14yes520 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:57yes1841 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 11:20yes2435 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:06no049 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:46yes1110 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:01yes611 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:10yes1627 s
ComparativePerplexity Sonarsonar2026-09-17 09:52yes2013 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 11:45yes3119 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 10:52yes1215 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 11:12yes1730 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:16yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:25yes952 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:56yes1638 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:34yes2077 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:28yes1230 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:12yes1411 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:06yes46 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:58yes1535 s
Budget constrainedPerplexity Sonarsonar2026-09-17 11:24yes127 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:36yes1813 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 10:33yes54 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:55yes2330 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:14yes53 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:38yes28126 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:27yes2372 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 14:00yes20155 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:43yes1589 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:26yes1814 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 14:00yes415 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:06yes931 s
Scale constrainedPerplexity Sonarsonar2026-09-17 09:31yes1711 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:50yes3217 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 12:54no09 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-09-17 13:01yes2886 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:16yes54 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:36no038 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:06no081 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:40yes29135 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:41yes966 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 09:40yes2810 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:50yes48 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:18yes1825 s
Negative framingPerplexity Sonarsonar2026-09-17 10:06yes208 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:54yes2116 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 11:13yes56 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 11:36yes2633 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 09:53yes54 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:33yes1435 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:38yes2873 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:09yes3385 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:24yes525 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
Attaxion read as Attaxion
BitSight read as Bitsight
Bitsight read as Bitsight
Censys read as Censys ASM
Mandiant/Google read as Mandiant Attack Surface Management
UpGuard read as UpGuard BreachSight
attaxion read as Attaxion
Unresolved, counted raw
Assetnote
Attack Surface Management Platform by AttackSurfaceManagement.com
CrowdStrike Falcon Security and IT Operations
FullHunt ASM
FullHunt Enterprise
Ivanti Neurons for EASM
Obsonis Enterprise
Ostorlab
Palo Alto Networks Cortex Xpanse / Cortex Exposure Management
Panaseer
Qualys EASM / VMDR
RedHunt Labs ASM Platform
Reposify
Shodan-style aggregators
Trickest ASM
Wiz Attack Surface Management
Discontinued, still offered
No shut-down product was recommended here.
← ZTNACompliance automation →