OWASP Amass vs Qualys External Attack Surface Management

OWASP Amass is a free, open-source framework for mapping attack surfaces and discovering external assets using OSINT and reconnaissance. It combines a collection engine, an asset database, and the Open Asset Model, which describes internet-exposed assets and their types, properties, and relationships. Collection sources include APIs, certificates, DNS, routing, scraping, web archives, and WHOIS. The database can store, manage, and retrieve discoveries for long-term tracking. The project says its mapping covers physical and digital assets, going beyond basic subdomain enumeration. Installation options include building from source with Go, Homebrew, an official Docker image, and Docker Compose. The project lists Go, network connectivity, DNS resolution, and basic network reconnaissance knowledge as requirements. Amass runs on Linux, macOS, and Windows, with self-hosted deployment. The v5.1.1 release notes mention an initial version of the engine REST API. The project is an OWASP Flagship Project and lists Apache 2.0; some subcomponents have separate licenses. The software costs nothing.

Qualys External Attack Surface Management gives security teams an outside-in view of internet-facing infrastructure and continuously monitors connected assets. It discovers domains, subdomains, cloud workloads, web applications, APIs, certificates, and exposed services, then identifies organizational ownership and maps asset relationships. The service can flag unapproved cloud services, test environments, abandoned assets, and other unmanaged resources, as well as changes to existing services and newly exposed assets. Qualys TruRisk scores prioritize discovered assets using vulnerabilities, misconfigurations, asset criticality, and external exposure. Assets can be added to inventory and scanned with VMDR. Listed native integrations include Certificate View, Policy Compliance, and Web Application Scanning. CSAM with EASM can produce PCI-DSS and FedRAMP asset security health reports and offers bidirectional ServiceNow CMDB integration. The managed service is accessed through a browser and needs no local server or software installation. A no-cost CSAM with EASM offer is listed at free for 30 days; other pricing is on request. Shodan-based discovery on leased IPv4 netblocks requires contacting a Qualys Technical Account Manager.