Halo Security vs OWASP Amass
Halo Security
halosecurity.comOWASP Amass
owasp.orgSide by side
| Figure | Halo Security | OWASP Amass |
|---|---|---|
| Price from | $60/mo | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | — |
| Self-hosted | — | Yes |
| Plans published | 4 | 1 |
| Spec score · Attack Surface Management Software | 7.8 (#13) | 8.1 (#9) |
| Founded | 2013 | 2001 |
| Integrations | Listed integrations include AWS, Azure, Google Cloud, Cloudflare, Jira, PagerDuty, Vanta, Splunk, Slack, Google Chat, ServiceNow, GoDaddy, Linode, F5 BIG-IP, and Zapier. | The project provides Docker and Docker Compose deployment options and documents configuring data sources with credentials. |
| Intended users | Halo describes its EASM platform as designed for lean teams and organizations with larger attack surfaces can request tailored enterprise plans. | The project describes its framework as helping information security professionals map attack surfaces and discover external assets. |
| Security and compliance | Halo Security identifies itself as a PCI DSS Approved Scanning Vendor (ASV). | The project page identifies OWASP Amass as an OWASP Flagship Project; the opened project pages state no security certifications or compliance attestations. |
| Support | Halo offers onboarding with its support team, and says most customers are fully onboarded within 3–7 days. | The project asks users needing installation or usage help to use its Discord server, where community members can help. |
Plans
Halo Security
- Application Scanning add-on$60 a month
- Compliance Reporting add-on$100 a month
- EASM$399 a month
- Manual Penetration Testing add-onPriced on request
In their own words
Halo Security
Halo Security has no write-up on Specifiction yet; its figures are above.
OWASP Amass
OWASP Amass is a free, open-source framework for mapping attack surfaces and discovering external assets using OSINT and reconnaissance. It combines a collection engine, an asset database, and the Open Asset Model, which describes internet-exposed assets and their types, properties, and relationships. Collection sources include APIs, certificates, DNS, routing, scraping, web archives, and WHOIS. The database can store, manage, and retrieve discoveries for long-term tracking. The project says its mapping covers physical and digital assets, going beyond basic subdomain enumeration. Installation options include building from source with Go, Homebrew, an official Docker image, and Docker Compose. The project lists Go, network connectivity, DNS resolution, and basic network reconnaissance knowledge as requirements. Amass runs on Linux, macOS, and Windows, with self-hosted deployment. The v5.1.1 release notes mention an initial version of the engine REST API. The project is an OWASP Flagship Project and lists Apache 2.0; some subcomponents have separate licenses. The software costs nothing.