How much does attack surface management cost?
The four pricing models vendors use
Per asset, metered
You pay for each monitored domain, IP or host, billed daily or monthly. Predictable per unit, but the bill moves every time discovery finds something new — which is the whole point of the product.
Capacity tiers
A fixed price for a fixed number of monitored assets. You know the bill in advance, and you choose when to move up a tier.
This is the model we use — see what we charge below.
Tiers with extras metered on top
A capacity tier that covers a base amount, with everything past it billed separately. One vendor's plans include five asset licences and charge for each one after that. Another advertises around $400 a month, then bills application scanning at around $60 per target per month, and PCI compliance reports as a further monthly line item.
Quote only
No public price at all. Common at the enterprise end, where the price is decided in a sales call. The figures that do become public run from tens of thousands to hundreds of thousands of dollars a year.
Why two quotes can't be compared directly
One vendor quotes a monthly price for 25 targets. Another quotes an annual price for 500 assets. A third meters per asset per day. These are three different units, and comparing the headline figures tells you almost nothing.
Convert everything to price per asset per year. Take two example plans. The first is advertised at $400 a month and covers 25 assets: that is about $192 per asset per year. The second is advertised at $12,000 a year and covers 250 assets: that is $48. The cheaper-looking price is four times as much per asset.
Then check four things the per-asset number still hides:
- Which tier actually covers you. Compare the tier that fits your asset count, not the entry tier in the headline — they are rarely the same one.
- What the vendor counts as an asset. Domains and IPs only, or every record discovered around them?
- What that tier leaves out. If the integrations, user seats or port coverage you need are only in the tier above, the entry price is not really your price.
- What is billed separately. Ask what the number does not cover: assets past the amount included in the plan, scanning priced per target, reports charged as their own monthly item, or a slower data refresh on the cheaper tier. The section below goes through these.
What actually drives the number
How much you actually expose
The single biggest factor, and the one nobody can estimate up front — finding that number is what you are buying the tool for. Any quote you accept before scanning is a quote for an amount neither side knows.
What counts as billable
Read this part of any quote carefully. Some vendors bill only the domains and IPs you choose to monitor; others count more of what discovery finds. One host can carry many ports, certificates and detected technologies, so this definition matters more than the unit price.
Which capabilities are locked to higher tiers
Cloud connectors, integrations, extra users, port coverage and audit reporting are often reserved for higher tiers, so the advertised entry price is rarely the price you end up paying.
Seats and support
User caps and tiered onboarding make you pay per person for work the whole team does.
What the price doesn't include
One vendor sells attack surface visibility — the actual product category — only in its top tier, the one with no public price. Its entry plan has no integrations at all, while the tier above has more than a dozen. Another advertises around $400 a month, then bills application scanning at around $60 per target per month, and PCI compliance reports as a further monthly line item.
A third tiers on something easier to miss: how fresh your data is. Its cheapest plan refreshes twice a month, and real-time monitoring costs about ten times as much. An inventory that updates twice a month is an inventory that is out of date most of the time — which is the problem the product was bought to solve.
Buyers say this plainly. Recurring complaints about this category are that "the license structure is too detailed", that the pricing plans are "confusing", and that per-discovered-asset pricing "doesn't really scale if you can't exclude certain domains".
How do you size it before you buy?
The number of assets you expose is the thing you are buying the tool to discover. Guessing it in advance is how organizations end up either paying for capacity they never use or hitting a limit in week two.
The answer is to scan first and choose the plan after. Run a trial, let discovery map the perimeter, and let the count at the end tell you which plan you need. If a vendor cannot show you that number before you commit, you are being asked to sign for an amount nobody has measured.
What we charge, and why
Vulmon Recon prices on one axis only: how many assets you keep in scope, from 50 on the entry plan to 500 on the largest self-serve one, with custom limits above that. Prices are on the pricing page — not behind a call.
Every plan ships the full product. Users and teams are unlimited, the API and every integration are included, and there are no support tiers. We think tiering features mostly punishes the smallest teams, who end up paying for a deliberately reduced version of the thing they came for.
Only what you put in scope is billable. Everything else discovery finds stays visible and documentable for free, because scope controls scanning and alerting — not whether you are allowed to see your own perimeter.
If you want to start without a budget, there is a free option. Recon Essentials is our free, self-hosted edition. It covers discovery and inventory, and it runs with Docker on your own machine with no time limit. Vulnerability findings, cloud connectors and integrations come with the hosted plans, with nothing to install.
Vulmon Recon comes from the team behind Vulmon, building vulnerability intelligence tools since 2017. That work taught us where vulnerability management actually breaks: not in researching a CVE, but in knowing which of your own systems is exposed to it. More about who we are.