Attack surface management pricing is the hardest line in a security budget to compare, because the number on the quote tells you almost nothing on its own. Two vendors can put similar annual figures in front of you for estates that differ by a factor of ten, simply because one counts registered domains and the other counts live internet-facing hosts. Procurement sees two similar figures. You are looking at two completely different products.

This is a buyer-side breakdown of how external attack surface management (EASM) is actually charged: the four models you will meet, the variables that quietly multiply your asset count mid-contract, the modules that sit outside the base licence, and the internal analyst time a cheap platform consumes. By the end you should be able to put the same six questions to every vendor on your shortlist and get answers you can line up side by side.

What you are actually paying for in an attack surface management subscription

External attack surface management covers six stages of work, and the gap between quotes almost always comes down to how many of them a vendor is willing to own:

  • Discovery of domains, subdomains, IP ranges, live hosts, cloud services, APIs, certificates and shadow IT deployed without security oversight.
  • Continuous monitoring with change detection, so new exposure is flagged when it appears rather than at the next quarterly review.
  • Assessment, meaning vulnerability and misconfiguration scanning against what discovery has found.
  • Intelligence: credential exposure, leak sites, forums, brand impersonation and employee exposure found through OSINT.
  • Remediation support, including evidence packs, risk grouping, takedown handling and advice on what to fix first.
  • Reporting for technical owners and for the board, plus integrations into the tooling your team already uses.

Cheaper quotes usually cover the first two stages and stop. That is not dishonest, but it is a scanner with a discovery engine attached, and the remaining four stages land on your team.

Platform licence versus human work

Split every quote in two. The licence pays for automated discovery, scanning, dashboards and alerting. The service element pays for people: analysts who investigate a finding, confirm whether an asset is genuinely yours, assemble evidence for a registrar, or trace an exposed credential back to a specific service.

Human analysis is the biggest price divider in this market. Automated tooling produces findings. Analysts decide which ones are real, which ones matter, and what the reader should do on Monday morning. Compare quotes on how much analyst involvement is included, not on how many widgets the dashboard has.

One-off assessment, penetration test or continuous monitoring

Buyers regularly put three different things in the same spreadsheet. A one-off external assessment is a snapshot of what was visible on a given week. A penetration test is scoped, time-boxed, manual exploitation work against agreed targets, and it answers a different question entirely. Continuous attack surface monitoring is an ongoing subscription that watches an estate that changes weekly.

Compare those three by price alone and the cheapest will always be the snapshot. It will also be out of date before the report is signed off.

The four pricing models you will meet, and how each one behaves

Consumption or billable-asset pricing

The bill tracks the count of confirmed assets discovery attributes to you, rather than a fixed monthly fee. Microsoft's Defender EASM is the best known example of this approach, with charging tied to billable assets rather than a flat subscription (see Microsoft's Defender EASM documentation for the current model, which is worth checking directly as cloud pricing changes).

Consumption pricing is honest in principle and awkward in practice for finance teams. Your invoice moves with discovery results, which means a good discovery run in month two can push you over the budget you agreed in month one.

Per-domain and per-host tiering

Entry plans look very cheap. Some external scanning tools publish low starting tiers covering a single domain with a small host allowance, then step up sharply as domains and hosts increase. UK buyers should normalise currency and VAT before putting a dollar-priced tier next to a sterling quote, and should read the host allowance carefully, because that allowance is where a mid-market estate breaks the tier.

Flat subscription plans banded by size or asset range

Banded plans price against organisation size or an asset range, which makes budgeting predictable and renewals boring, both of which are virtues. The risk is fit. A band set at "up to 500 assets"either over-serves a tightly managed estate or quietly under-serves a group with six trading brands and a decade of marketing microsites. Ask what happens at the band ceiling, and ask before you sign.

Per-identity, per-seat and day-rate elements

Executive and VIP monitoring is usually priced per protected identity, because the work is per person: tracking exposure of a named director across breach data, social platforms, data brokers and impersonation attempts. Managed scanning and bespoke OSINT research are often sold as day rates or retainers. Extra platform users sometimes carry a per-seat charge, which matters if you want engineering leads to see their own findings rather than receive a monthly PDF.

What really drives your bill: how assets get counted

The unit is worth more than the rate

An "asset"can mean a registered domain, a subdomain, an IP address, a live host, a web application, a TLS certificate or a cloud instance. The definition changes the invoice far more than the headline rate does. Get the counting rule in writing, including whether non-responsive hosts, parked domains, wildcard subdomains and certificates count, and whether a host with four services on it is one asset or four.

Attack surface drift, true-ups and caps

Asset counts are not static. Discovery routinely returns several times more internet-facing assets than the internal inventory or CMDB holds, and the number keeps climbing: ephemeral cloud instances, campaign microsites spun up by an agency, acquired brands that arrive with their own DNS, staging environments nobody switched off.

A familiar pattern: a 500-person UK group with three trading brands has roughly 200 external assets in its CMDB. Discovery returns several hundred subdomains, plus forgotten staging and marketing hosts. On a per-asset or tiered model that organisation moves two pricing tiers in a fortnight, before anyone has fixed a single finding.

So treat true-up and cap clauses as a budget control, not legal small print. Ask how growth is handled mid-contract, whether there is a ceiling, and whether you can exclude assets you have deliberately decided not to monitor.

Brands, countries and regional infrastructure

Multiple trading names, country-code domains and regional hosting multiply discovery scope. A group operating as three brands across the UK, Ireland and Germany is three discovery seeds, not one, and the pricing conversation should reflect that rather than pretending the estate is a single tidy domain.

Scanning depth and frequency

Infrastructure-only scanning is cheaper than dual infrastructure and web application scanning, and it is also blind to the application-layer issues that cause most of the breaches you read about. Authenticated scanning costs more again, because it needs credentials, scoping and care. Rescan frequency is the third dial: weekly rescans on a changing estate cost more compute than monthly ones, and are worth it when your developers deploy daily.

The cost lines that sit outside the licence fee

Several capabilities buyers assume are bundled tend to sit in separate modules. Check each one against the base plan:

  • Domain takedowns. Removing a typosquat or lookalike domain is work, not a toggle. Each case needs an evidence pack, registrar or host correspondence and follow-up, and can run for weeks. Ask whether takedowns are unlimited, capped per year, or billed per case.
  • Dark web, leak site and Telegram monitoring, plus leaked credential lookups. Often a separate module, and often the one that gets cut from a quote to hit a number. If you want detail on where this coverage fails, our breakdown of gaps in leaked credential monitoring is a useful companion to a vendor conversation.
  • Brand impersonation work, including reverse image search for fake profiles and cloned sites, and supplier or third-party risk checks.
  • Executive and VIP identity monitoring, priced per protected person as described above.
  • Onboarding, ownership verification and scoping. Any vendor that scans responsibly has to confirm you own what it is about to probe, agree scanning boundaries with you, and keep each customer's data separated. That costs time. We set out how this is handled in our responsible EASM and data separation approach. A vendor that cannot explain its verification process is not cheaper, it is riskier.
  • Integrations and reporting. Ticketing and SIEM connectors, API access, board reporting packs and additional user seats. Our notes on integrating threat intelligence without adding noise cover what good looks like here.

The hidden cost nobody quotes: analyst hours spent on duplicate findings

Run infrastructure and web application scanning over the same estate and you will get overlap. The same outdated component surfaces from two directions, on four hosts behind one load balancer, across two environments. Whether the platform deduplicates, groups by root cause and auto-resolves fixed issues decides how many hours a "cheap"licence actually consumes.

Do the arithmetic before you sign. Take an honest planning estimate for a loaded internal day rate, somewhere around £300 to £450 for a UK mid-market analyst once employment costs are included, and apply it to the triage time you expect. Six hours a week of sorting duplicates and low-value findings is roughly three quarters of a day, every week, for a year. Against many annual licence fees, that is the larger number.

Risk grouping has a commercial effect too. Findings bundled into remediation projects become assigned work with an owner and a deadline. Raw alert lists become backlog, then become ignored, which is how teams end up with a monitored estate and an unchanged risk profile. If alert volume is already a problem for you, our piece on the main sources of security alert noise explains where it accumulates.

Then there is the credibility cost. Send engineering three false positives and the fourth finding, the real one, gets triaged into next sprint. That damage never appears on an invoice.

How to compare attack surface management quotes like for like

Six questions to put to every vendor in writing

  1. What is the unit of billing, stated precisely, and what does not count?
  2. How does discovery decide an asset is yours, and can you dispute attribution?
  3. What happens commercially when the asset count grows mid-contract? Is there a cap?
  4. What is included for takedowns: unlimited, capped, or per case?
  5. Is the research automated, human-led, or a stated mix, and how many analyst hours are included?
  6. How is each organisation's data separated, and how is ownership verified before scanning begins?

Pilot on one brand, then compare counts and quality

Feature grids are useless at this stage. Scope a trial to one brand or business unit, give every shortlisted vendor the same seeds, and compare two things: how many assets each returned that your inventory did not hold, and how many of their findings an engineer agreed were real and worth fixing. That second number is the whole purchase. A scoped trial run on a single business unit will tell you more in a fortnight than three months of demos.

Build versus buy

You can stitch together subdomain enumeration, certificate transparency feeds, internet-wide scan data, an open-source scanner and a credential source. The tooling is genuinely good and genuinely free. The cost is the engineer who maintains it, the attribution logic that stops it alerting on someone else's estate, the deduplication nobody wants to write, and the dark web access you cannot responsibly reproduce in-house. Build if you have a dedicated platform engineer with spare capacity. Most mid-market teams do not.

Framing the business case

Tie the spend to exposures found and closed, not to coverage claims. The sharpest value test is live advisory response: when the NCSC issues an alert, or a critical flaw lands in something like an internet-facing ServiceNow instance, a PaperCut NG print server or a WordPress remote code execution chain, the board wants an estate-wide answer within days. If your subscription can tell you in an afternoon whether you are exposed, and the alternative is a week of manual checking, you have your justification.

Scope the counting rule first, price it second. If you want to see how plans are banded against assets, brands and analyst involvement, the DarkInsight plans and pricing are set out at darkinvader.io, and attack surface management pricing becomes a far easier conversation once you know exactly what you are being charged per unit of.

Frequently Asked Questions

How much does attack surface management cost for a UK mid-market business?

There is no single market rate, because the charge depends on the counting unit, the number of brands and the amount of human analysis included. What you can do is standardise the comparison: ask every vendor to quote against the same seed domains and the same scope, and ask for the per-unit rate alongside the total. Expect genuine continuous monitoring with analyst involvement to cost meaningfully more than an automated scanner with a dashboard.

What counts as a billable asset, and why does the definition change the price?

Depending on the vendor, an asset may be a registered domain, a subdomain, an IP address, a live responsive host, a web application, a certificate or a cloud instance. A 500-person group might hold 200 assets by one definition and well over a thousand by another, which is why the same headline figure can represent very different value. Always get the counting rule, and the exclusions, in writing.

Is attack surface management pricing usually per asset, per domain or per user?

All three exist, often in the same quote. Core discovery and monitoring tends to be per asset or banded by domain and host allowance, executive and VIP identity monitoring is normally per protected person, and managed scanning or bespoke research is commonly a day rate or retainer. Consumption models such as Microsoft Defender EASM bill against confirmed assets, so the invoice moves as discovery finds more.

What is normally charged as an extra on top of the subscription?

Domain takedowns, dark web and Telegram monitoring, leaked credential lookups, brand impersonation research, supplier risk checks, executive monitoring, additional user seats, API access and integration work are all frequently separate modules. Onboarding and ownership verification may also be a one-off line. Ask for the full price list rather than the plan summary.

Is a free external scan enough, or do you need continuous monitoring?

A free scan is a useful way to see whether a vendor's discovery finds things your inventory does not, and it often does. What it cannot do is catch the microsite deployed next month, the staging host exposed after a release, or the credential set that appears on a leak site in March. Estates change weekly, so a snapshot answers "were we exposed then", not "are we exposed now".