External threat management vendors: who they are and how CISOs compare them

CISO Tribune's record files 34 external threat management vendors as of 18 October 2026. Their products watch what an organization exposes beyond its network: internet-facing assets, leaked data, impersonation of its brand and executives, and the actors and infrastructure aimed at it. Chief information security officers (CISOs) compare them on coverage of that outside view, how findings are verified and whether results reach the people and tools that act.

Key facts

• "External threat management" is a buying phrase, not a product category: Gartner defines external attack surface management as a market of its own, and our taxonomy splits the vendors into three categories.
• Gartner lists digital risk protection monitoring as a mandatory feature of cyberthreat intelligence technologies (updated August 2026), so the categories overlap.
• The Cybersecurity and Infrastructure Security Agency's (CISA) Binding Operational Directive 23-01 has required US federal civilian agencies to run automated asset discovery every 7 days since 3 April 2023.
• The Federal Bureau of Investigation's (FBI) Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, up from 859,532 in 2024.
• Business email compromise (BEC) cost victims $3,046,598,558 in 2025, according to the 2025 IC3 Annual Report.
• The UK National Cyber Security Centre (NCSC) Takedown Service removed 1.2 million cyber-enabled commodity campaigns between 1 September 2024 and 31 August 2025.
• The European Union Agency for Cybersecurity (ENISA) found vulnerability exploitation behind 60.4% of the unauthorised access it recorded in 2025.

What external threat management vendors sell

"External threat management" describes a goal rather than a product: seeing the organization as an outside attacker sees it. On CISO Tribune's taxonomy, vendors selling toward that goal file under three categories, defined in our own words:

• External attack surface management (EASM): continuous discovery and monitoring of an organization's internet-facing assets from an outside-in view.
• Digital risk protection (DRP): monitoring of the open, deep and dark web and social platforms for brand abuse, leaked data and impersonation, with takedown services.
• Threat intelligence: feeds, platforms and research services about threat actors, infrastructure, malware and vulnerabilities being exploited.

Gartner describes EASM tools as ones that "continuously discover, inventory, and monitor an organization's internet-facing digital assets." The glossary of the National Institute of Standards and Technology (NIST), citing its Special Publication 800-150, defines threat intelligence as threat information that has been aggregated, analyzed, interpreted or enriched to give context for decisions. In procurement terms, EASM answers what you expose, DRP answers who is abusing your name and data, and threat intelligence answers who is coming and how.

Neighbouring categories sit outside the umbrella. Cyber asset attack surface management (CAASM) works inside-out from tools already deployed, and vulnerability management scans systems the organization knows it owns. Continuous threat exposure management (CTEM) ranks findings across scanners, and third-party risk and security ratings turns the outside-in view on suppliers. Many vendors sell across these lines, which is why our record files some of them in several categories.

In MITRE's ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework, most of what these products watch sits in two tactics. Reconnaissance (TA0043) covers adversaries gathering information to plan future operations and lists 12 techniques, from active scanning to searching victim-owned websites. Resource Development (TA0042) lists nine, including acquiring domains and generating content to impersonate known individuals or organizations. EASM looks at what reconnaissance would find; DRP and threat intelligence look at the resources being built.

What the standards and agencies say about external threat management

No standard names these product categories. The documents below set outcomes, cadences and data formats that a product either supports or does not.

NIST Cybersecurity Framework (CSF) 2.0, 26 February 2024. The CSF 2.0 asks for maintained inventories of hardware (ID.AM-01) and of software, services and systems (ID.AM-02). Under Risk Assessment, cyber threat intelligence is received from information sharing forums and sources (ID.RA-02), and internal and external threats are identified and recorded (ID.RA-03). In the Detect function, DE.AE-07 asks that threat intelligence be integrated into analysis of adverse events. Our read: a product should show, with evidence, which of these outcomes it produces.

CISA Binding Operational Directive 23-01, 3 October 2022. The directive binds US federal civilian executive branch agencies. Since 3 April 2023 they must run automated asset discovery every 7 days, covering at least their whole IPv4 space, and enumerate vulnerabilities on discovered assets every 14 days. Companies are not bound, but the cadence is a fair benchmark when a vendor quotes its discovery frequency.

CISA Cyber Hygiene services. CISA's vulnerability scanning costs nothing for US federal, state, local, tribal and territorial governments and for public and private critical infrastructure organizations. Enrolled organizations get weekly reports and ad hoc alerts on urgent findings, including known exploited vulnerabilities. Eligible buyers can run it beside a commercial EASM trial and compare what each finds.

CISA Internet Exposure Reduction Guidance, revised 21 August 2026. The guidance tells organizations to use web-based exposure discovery tools routinely on their own information technology and operational technology (OT) assets. It asks them to search their known internet protocol (IP) address space and also assets exposed through vendors, contractors or legacy infrastructure. That second instruction is the job EASM products are sold to do.

Sharing formats. STIX (Structured Threat Information Expression) 2.1 is a language and serialization format for exchanging cyber threat intelligence. It is a standard of the Organization for the Advancement of Structured Information Standards (OASIS), last corrected on 2 April 2025. Its companion, TAXII (Trusted Automated Exchange of Intelligence Information), is built to transport STIX objects. Gartner lists STIX/TAXII integration among the mandatory features of threat intelligence technologies.

The Forum of Incident Response and Security Teams (FIRST) maintains the Traffic Light Protocol (TLP), whose version 2.0 has been authoritative since August 2022. Its four labels set how far shared information may travel, and a recipient who wants to share more widely than the label allows must get explicit permission from the source. A vendor that redistributes intelligence from sharing communities should show how it enforces those labels.

Takedown benchmarks. The NCSC's annual review reports that 50% of phishing attacks on UK government departments were taken down in under an hour, against about four hours the year before. It also reports that 79% were resolved within 24 hours of detection. A DRP contract should state its own takedown times so they can be read against public figures like these.

Threat data. The IC3 report counted 191,561 phishing and spoofing complaints and 24,768 BEC complaints in 2025. ENISA's report covering 1 January to 31 December 2025 found phishing in 77.8% of the social engineering it recorded. These figures describe demand for DRP and threat intelligence; they say nothing about any product.

Who the external threat management vendors are

On CISO Tribune's record as of 18 October 2026, 34 vendors file under at least one of the three categories: 14 under external attack surface management, 7 under digital risk protection and 22 under threat intelligence. Seven file under two or three of them. Only 16 have one of the three as their primary category. The other 18 sell mainly something else, most often managed detection and response, third-party risk or security operations center (SOC) platforms, and add an external product.

The record lists none of the 34 as publicly traded: 7 are private, 5 are owned by another company or investor, and the record does not state ownership for 22. By headquarters, 11 are in the United States, 2 each in Sweden and the United Kingdom, and 1 each in Australia, France, the Netherlands and Spain; the record gives no headquarters for 15.

What they share is the outside-in vantage point: data gathered from the internet rather than from agents inside the network. They differ in what they collect, who analyzes it and what happens next. Censys sells a dataset of internet-connected hosts, GreyNoise labels internet scanning traffic and VulnCheck sells exploit and vulnerability intelligence.

BlackCloak removes executives' personal data from broker sites, while iCOUNTER detects threats aimed at an organization's suppliers. Red Sift pairs email authentication with lookalike-domain detection and takedown, Filigran offers the open-source OpenCTI platform, and ZeroFox combines all three categories in one platform.

The full list is below this guide, alphabetical within each category.

How CISOs compare external threat management vendors

Four decisions carry most of the weight.

One supplier or several. Gartner already counts DRP monitoring as a mandatory feature of threat intelligence technologies, and seven vendors on our record file in more than one of the three categories. A single platform cuts integration work; a specialist may collect more deeply in one area. Decide which outcome matters most before the first demonstration.

Attribution before features. Our read: settle asset scope, ownership and the remediation workflow before the first demonstration, then benchmark discovery accuracy and integration fit during the evaluation. A pilot that finds hundreds of assets nobody can assign to an owner adds noise, not visibility.

Collection and legal exposure. DRP and threat intelligence vendors collect from dark web forums, leak sites and social platforms, and some offer analyst services on top of the data. Ask counsel how access is obtained, whether analysts interact with threat actors, whether buying stolen data is allowed, and how leaked personal data about employees is stored and deleted.

Takedown terms and exit. Takedowns depend on registrars, hosts and platforms the vendor does not control. Our read: expect a contract to promise filings and response times rather than outcomes, and price it accordingly. Agree an export of asset history, alerts and takedown records before signing, so a successor does not start from zero.

What a proof of concept should test

• Give the vendor only your primary domain and compare what it attributes to you within two weeks against your own inventory and, if eligible, CISA Cyber Hygiene results.
• Register a lookalike domain or create a fake profile you control, then time detection and the takedown filing.
• Take 20 alerts from the trial and count how many were validated, relevant and actionable.
• Push a sample feed into your security tooling over TAXII and confirm the TLP labels survive.
• Map trial findings to TA0043, TA0042 and ID.RA-03 and note where coverage stops.

Procurement traps

• If pricing is per discovered asset or monitored domain, the bill grows as discovery improves; fix the unit and a ceiling before the pilot.
• If takedowns are billed per item or capped per year, a brand-heavy program can cost more than the platform.
• If executive protection is priced per person, agree in writing who counts and what happens when people join or leave.
• "Dark web monitoring" can mean keyword search or analyst access to closed forums; get the source list and collection method in the contract.

What changed in 2025 and 2026

• Consolidation in 2025. Sophos completed its purchase of Secureworks on 3 February 2025 in an all-cash deal valuing it at about $859 million, adding the Counter Threat Unit to its threat intelligence work (Sophos). Zscaler completed its acquisition of Red Canary on 1 August 2025 (Zscaler).
• Intelligence platforms merged. On 21 October 2025, Dataminr announced its intent to acquire ThreatConnect in a deal valuing it at $290 million (Dataminr); our record shows the deal completed in November 2025.
• Deepfakes entered the DRP brief. On 2 September 2025, Gartner reported that 62% of organizations in its survey of cybersecurity leaders had faced at least one deepfake attack in the previous 12 months. It said threat intelligence and DRP services are already components of disinformation security.
• The FBI counted AI-enabled crime. The IC3 report published on 6 April 2026 carried its first section on artificial intelligence (AI): 22,364 complaints and nearly $893 million in losses. Total reported losses reached $20.877 billion, 26% more than in 2024.
• Exposure discovery became routine advice. CISA's exposure reduction guidance, revised on 21 August 2026, cites malicious activity in July 2026 against internet-exposed systems at more than 100 water and wastewater entities.
• Asset discovery moved into OT security. On 21 September 2026, Dragos said it had acquired runZero, to extend asset visibility and exposure management across its extended operational technology (xOT) platform (Dragos).

Related reading

For exposures inside the network and how they are ranked, see the CTEM vendors guide; for the teams that act on external alerts, see the SOC vendors guide. Public companies describe how they oversee these risks in their 10-K filings, collected on our disclosures record. The rules are explained in our guide to the Securities and Exchange Commission (SEC) cybersecurity disclosure rules for CISOs and the Item 1.05 materiality guide. Terms used here are defined in the CISO security glossary.