runZero vs XM Cyber Exposure Management
runZero
runzero.com
XM Cyber Exposure Management
xmcyber.comSide by side
| Figure | runZero | XM Cyber Exposure Management |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 3 | 1 |
| Spec score · Exposure Management Software | 8.5 (#3) | 7.5 (#11) |
| Data protection | runZero states that customer data is logically separated and encrypted at rest and in transit. | The maker says customer data is protected in transit with TLS and at rest with AES-256 encryption. |
| Discovery | The platform combines high-speed active scanning, passive traffic sampling, and API integrations into a continuously updated inventory. | XM Cyber describes continuous monitoring with both agent-based and agentless discovery. |
| Integrations | Inbound integrations include AWS, Google Cloud, Azure, Prisma, VMware, Wiz, CrowdStrike, Microsoft 365 Defender, Intune, Miradore, SentinelOne, Tanium, MECM and Google Workspace. | It integrates with ticketing, SIEM, and SOAR tools; named integrations include AWS, CrowdStrike, Google SecOps, Microsoft Defender, ServiceNow, and QRadar. |
| Purpose | runZero is an attack surface and exposure management platform covering IT, OT, IoT, cloud, mobile, and remote assets. | The platform continuously discovers, prioritizes, and helps fix validated exposures that could lead to critical assets. |
| Support | runZero offers documentation, API resources, release notes, a Trust Center, and human support through the console or contact form. | Customers are assigned a Customer Success Manager to assist with initial setup and training, and can access a support portal with user guides and a knowledge base. |
| Target users | The Community Edition is designed for small businesses, individuals, and security researchers with 100 or fewer assets, while the Platform is built for enterprises. | XM Cyber describes the platform as serving security teams at high-value organizations and the Schwarz Group ecosystem. |
Plans
runZero
- Community EditionFree
- Community EditionFree
- runZero PlatformPriced on request
XM Cyber Exposure Management
- XM Cyber Exposure ManagementPriced on request
In their own words
runZero
runZero is an attack surface and exposure management platform for inventorying IT, OT, IoT, cloud, mobile, and remote assets. It combines active scanning, passive traffic sampling, and API integrations to keep the inventory updated. Tracked information can include assets, services, screenshots, software, vulnerabilities, certificates, wireless devices, users, and groups. Reports include layer-2 topology maps and asset risk; alerts can appear in-product or arrive by email or webhook, including Slack. The service can run as hosted SaaS or on-premise using Consoles, distributed Explorers, and a command-line tool. runZero says it operates without agents, authentication, or appliances. Prebuilt integrations span cloud providers, EDRs, MDMs, vulnerability scanners, ITSM systems, and detection platforms, with an API and scripts for custom integrations. Community Edition is free for up to 100 assets, one organization, 10 recurring tasks, and 30 days of data retention. The Platform costs what you agree with the maker. Self-hosting the console requires a Platform license with runZero Care explicitly enabled.
XM Cyber Exposure Management
XM Cyber Exposure Management is a subscription-based SaaS platform for finding and addressing validated exposures that create attack paths to critical assets. It continuously discovers CVEs, misconfigurations, and identity and access exposures across external, on-premises, cloud, and multi-cloud environments, using agent-based and agentless discovery. Its prioritization considers threat intelligence, exploitation likelihood in the customer’s environment, asset criticality, and business impact. Attack path analysis highlights choke points where remediation can remove multiple paths. The platform provides urgency and impact context, remediation guidance, alternatives, and validation. Cloud capabilities include agentless posture monitoring, vulnerability assessment for cloud hosts and containers, and visibility into permissions and their use. It can also discover shadow AI and map exposures affecting AI services, development resources, MCP servers, and agents. Integrations include ticketing, SIEM, and SOAR tools, with named connections such as AWS, CrowdStrike, Google SecOps, Microsoft Defender, ServiceNow, and QRadar. Pricing is on request. The company describes deployment as SaaS on Google Cloud Platform infrastructure by default for new environments.