# Amass vs Microsoft Defender EASM

**Leader by vioscaleAI score:** Microsoft Defender EASM

| Attribute | Amass | Microsoft Defender EASM |
|---|---|---|
| **vioscaleAI score** | 42.4 (27% (low)) | 51 (37% (low)) |
| activity.commits_last_30d | 0 | - |
| adoption.dependent_repos | 0 | - |
| adoption.github_stars | 15,355 | - |
| content.faq | `[{"answer":"Amass is open source, so it can be self-hosted and used at no licence cost. Pricing changes often, so verify at source before relying on it.","source":"https://owasp.org/www-project-amass/","question":"Is Amass free to use?","confidence":0.6},{"answer":"Amass supports a command-line interface. Platforms we have not confirmed are simply not listed here rather than ruled out.","source":"https://owasp.org/www-project-amass/","question":"What platforms does Amass support?","confidence":0.6},{"answer":"Yes. Amass can be deployed self-hosted, so it does not have to run on the vendor's infrastructure.","source":"https://owasp.org/www-project-amass/","question":"Can Amass be self-hosted?","confidence":0.6}]` | `[{"answer":"A cloud-based security service that discovers internet-facing resources and identifies vulnerabilities to help organizations proactively manage their external attack surface and security risks. It is indexed under Attack Surface Management.","source":"https://azure.microsoft.com/en-us/pricing/details/defender-external-attack-surface-management/","question":"What is Microsoft Defender EASM?","confidence":0.6},{"answer":"Microsoft Defender EASM does not publish its prices. Pricing is quoted on request, so the figure depends on your seat count and requirements. We record this as a pricing-transparency signal rather than guessing a number. Pricing changes often, so verify at source before relying on it.","source":"https://azure.microsoft.com/en-us/pricing/details/defender-external-attack-surface-management/","question":"How much does Microsoft Defender EASM cost?","confidence":0.6},{"answer":"We have only confirmed a cloud / SaaS deployment for Microsoft Defender EASM, so it appears to be vendor-hosted. If a self-hosted option exists we have not found it documented publicly.","source":"https://azure.microsoft.com/en-us/pricing/details/defender-external-attack-surface-management/","question":"Can Microsoft Defender EASM be self-hosted?","confidence":0.6},{"answer":"We have independently confirmed SOC 2, ISO 27001 and GDPR for Microsoft Defender EASM. Certifications we do not list are ones we have not been able to verify from public sources, which is not the same as Microsoft Defender EASM not holding them. Always confirm compliance directly before you rely on it.","source":"https://azure.microsoft.com/en-us/explore/trusted-cloud/","question":"What security certifications does Microsoft Defender EASM have?","confidence":0.7},{"answer":"Microsoft Defender EASM is available worldwide. Its primary market is the United States.","source":"https://azure.microsoft.com/en-us/pricing/details/defender-external-attack-surface-management/","question":"Where is Microsoft Defender EASM available?","confidence":0.5}]` |
| deployment.options | `{"self_hosted":true}` | `{"cloud":true}` |
| description.long | A framework that identifies external assets and attack surfaces through reconnaissance and open-source intelligence gathering techniques, helping security professionals understand their organization's external exposure. | A cloud-based security service that discovers internet-facing resources and identifies vulnerabilities to help organizations proactively manage their external attack surface and security risks. |
| features.capabilities | `{"pricing_model":"open_source","deployment_model":"standalone_cli","automated_asset_attribution":true,"agentless_external_discovery":true}` | `{"pricing_model":"quote","deployment_model":"cloud_managed_easm","agentless_external_discovery":true}` |
| integrations.count | 83 | - |
| integrations.list | `[{"name":"GitHub","native":true,"direction":"inbound"},{"name":"GitLab","native":true,"direction":"inbound"},{"name":"Shodan","native":true,"direction":"inbound"},{"name":"Google","native":true,"direction":"inbound"},{"name":"Bing","native":true,"direction":"inbound"},{"name":"SecurityTrails","native":true,"direction":"inbound"},{"name":"Greynoise","native":true,"direction":"inbound"},{"name":"HackerOne","native":true,"direction":"inbound"}]` | - |
| language.primary | Go | - |
| market.availability | `{"hqCountry":"US","primaryMarkets":[],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` | `{"primaryMarkets":["US"],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` |
| platform.support | `{"cli":true}` | - |
| pricing | `{"type":"quote","plans":[{"free":false,"name":"Silver Corporate Supporter","summary":"$5,000 annually (or $2,000 regional/startup)","components":[{"kind":"one_time","amount":5000,"currency":"USD"}],"description":"Logo placement, 1 annual social media campaign","contactSales":false},{"free":false,"name":"Gold Corporate Supporter","summary":"$15,000 annually (or $6,000 regional)","components":[{"kind":"one_time","amount":15000,"currency":"USD"}],"description":"2 annual social media campaigns, Global AppSec event slide exposure","contactSales":false},{"free":false,"name":"Platinum Corporate Supporter","summary":"$25,000 annually (or $10,000 regional)","components":[{"kind":"one_time","amount":25000,"currency":"USD"}],"description":"Maximum visibility, 4 annual social media campaigns, priority placement, sponsorship subsidy","contactSales":false}],"currency":"USD","sourceUrl":"https://owasp.org/www-project-amass/","retrievedAt":"2026-09-11T19:11:04.073Z","startingPrice":{"amount":5000,"currency":"USD"}}` | `{"type":"quote","currency":"USD","sourceUrl":"https://azure.microsoft.com/en-us/pricing/details/defender-external-attack-surface-management/","retrievedAt":"2026-09-04T17:56:18.110Z"}` |
| pricing.free_tier | yes | - |
| pricing.model | open_source | quote |
| pricing.price_level | free | unknown |
| pricing.starting_price | `{"amount":5000,"currency":"USD"}` | - |
| pricing.transparent | yes | no |
| release.cadence_days | 32 | - |
| release.history | `[{"url":"https://github.com/owasp-amass/amass/releases/tag/v5.1.1","date":"2026-04-07T02:08:08Z","type":"stable","version":"v5.1.1"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v5.0.1","date":"2025-09-04T20:54:12Z","type":"stable","version":"v5.0.1"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v5.0.0","date":"2025-08-03T15:31:46Z","type":"stable","version":"v5.0.0"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v4.2.0","date":"2023-09-10T20:52:27Z","type":"stable","version":"v4.2.0"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v4.1.0","date":"2023-07-29T02:37:39Z","type":"stable","version":"v4.1.0"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v4.0.4","date":"2023-07-25T19:36:18Z","type":"stable","version":"v4.0.4"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v4.0.3","date":"2023-07-24T04:47:39Z","type":"stable","version":"v4.0.3"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v4.0.2","date":"2023-07-20T21:01:46Z","type":"stable","version":"v4.0.2"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v4.0.1","date":"2023-07-20T01:16:08Z","type":"stable","version":"v4.0.1"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v3.23.3","date":"2023-06-20T22:10:49Z","type":"stable","version":"v3.23.3"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v3.23.2","date":"2023-05-09T15:54:52Z","type":"stable","version":"v3.23.2"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v3.22.2","date":"2023-03-21T03:48:13Z","type":"stable","version":"v3.22.2"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v3.22.1","date":"2023-03-14T03:41:56Z","type":"stable","version":"v3.22.1"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v3.22.0","date":"2023-03-08T01:26:11Z","type":"stable","version":"v3.22.0"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v3.21.2","date":"2022-12-11T19:21:26Z","type":"stable","version":"v3.21.2"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v3.21.1","date":"2022-12-09T07:29:22Z","type":"stable","version":"v3.21.1"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v3.21.0","date":"2022-12-09T07:11:23Z","type":"stable","version":"v3.21.0"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v3.20.0","date":"2022-09-23T05:04:27Z","type":"stable","version":"v3.20.0"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v3.19.3","date":"2022-06-23T22:43:35Z","type":"stable","version":"v3.19.3"},{"url":"https://github.com/owasp-amass/amass/releases/tag/v3.19.2","date":"2022-04-16T21:47:19Z","type":"stable","version":"v3.19.2"}]` | - |
| security.gdpr | - | yes |
| security.iso27001 | - | yes |
| security.scorecard | 3 | - |
| security.soc2 | - | yes |
| security.trust_center | https://owasp.org/blog/2024/03/07/OWASP-CycloneDX-is-ready-to-support-your-CRA-compliance-journey.html | https://azure.microsoft.com/en-us/explore/security/ |
| security.vulnerabilities | `{"count":0,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=github.com%2Fowasp-amass%2Famass%2Fv3%2Fnet%2Fhttp&per_page=100","last_12m":0,"max_severity":null}` | - |

## Capabilities (Attack Surface Management)

| Capability | Amass | Microsoft Defender EASM |
|---|:--:|:--:|
| **Capabilities** |  |  |
| Deployment model | Standalone CLI | Cloud managed easm |
| Continuous daily scanning | - | - |
| Agentless external discovery | ✓ | ✓ |
| Automated asset attribution | ✓ | - |
| Cloud cspm integration | - | - |
| Certificate transparency monitoring | - | - |
| Dark web exposure monitoring | - | - |
| Servicenow CMDB sync | - | - |
| Jira ticketing integration | - | - |
| Cve vulnerability mapping | - | - |
| SOC2 type ii | - | - |
| ISO 27001 | - | - |
| Pricing model | Open source | Quote |

*Source: vioscaleAI. Generated 2026-10-16T19:01:53.237Z. "-" = undocumented, not absent.*