CTM360 vs Outpost24 Attack Surface Management

CTM360 is a cybersecurity platform for discovering vulnerabilities and managing threats across the surface, deep, and dark web. Its HackerView service finds digital assets, identifies issues, and passively maps an organization’s public digital presence. Security ratings cover 11 risk categories and more than 90 issues, with an A–F grade for each category. Other listed capabilities include phishing and brand protection, social media fraud monitoring, executive impersonation monitoring, and managed takedowns. ThreatCover provides curated threat feeds prioritized and mapped to the MITRE ATT&CK framework. RiskHub supports third-party security assessments using questionnaires, external monitoring, and internal security controls. CTM360 is available on the web and through an API, and describes setup as requiring no installation or configuration. It says its support is available 24 hours a day, 365 days a year. The Community Edition is free, limited to one authorized user per organization, and includes three free takedowns. Paid plans start at $5,000/yr+. Base-price managed services cover one brand and one primary domain with its subdomains; additional brands or primary domains incur extra charges.

Outpost24 Attack Surface Management is a cloud-based service for finding and monitoring an organization’s internet-facing assets. It discovers domains, IP addresses, cloud infrastructure, network hosts, ports, fully qualified domain names, and shadow IT through passive, hybrid, and advanced reconnaissance. Asset discovery does not require agents, credentials, or network access. Continuous scanning, change detection, real-time alerts, and automated monitoring track changes over time. Automated attack-surface scoring and contextual analysis prioritize assets and findings by exposure, impact, and asset criticality. Dashboards, prioritized trackers, risk trends, and remediation-progress tracking support follow-up. Security features include subdomain and look-alike-domain discovery, certificate monitoring, advanced port scanning, customizable alerts, and reporting. Digital risk protection can identify leaked credentials, documents, and information, monitor underground forums, and track unauthorized brand use on social media. The platform offers API access and integrations with Jira, ServiceNow ITSM, Palo Alto Cortex XSOAR, AWS, Microsoft Azure, Axonius, Microsoft Teams, Slack, CSC Domain Manager, and Microsoft Sentinel. It is accessed through a secure browser login, with pricing on request and customized packages.