Hexiosec ASM - 2026 Pricing, Features, Reviews & Alternatives

Hexiosec ASM is an external attack surface management (EASM) platform that discovers, assesses and monitors every internet-facing asset connected to your organisation, including the assets you didn't know you had.

Provide a domain, IP address or IP range and Hexiosec ASM's proprietary enumeration engine maps your externally visible infrastructure: subdomains, IPs, exposed ports, TLS/certificate configuration, email security configuration (SPF/DKIM/DMARC), and running software versions.

Rather than relying on aggregated third-party data feeds, the discovery and risk-assessment logic is built in-house by engineers with UK government and defence backgrounds. Which is why it consistently surfaces more assets, with fewer false positives, than comparable tools.

Every discovered asset is checked against known CVEs, common misconfigurations and known exploited vulnerabilities (KEV), then scored using EPSS insights to help you prioritise real-world exploitability over raw CVSS severity alone. Results are grouped into "Actions", a Kanban-style workflow for planning and tracking remediation, rather than left as an undifferentiated list of findings.

Scanning is passive and non-intrusive by design, so it's safe to run against your own estate or against third parties for due diligence, supplier onboarding or M&A technical assessment, without needing permission or risking disruption.

Specs and technical detail:

- Scan frequency: weekly (Free), daily (Premium and Enterprise)

- Scan scope: up to 50 assets (Free), up to 300 assets (Premium), scaling to your full estate (Enterprise)

- Detection: subdomain/IP discovery, CVE detection, TLS configuration, component/software version detection, email configuration checking, web presence screenshots

- Risk workflow: risk metrics over time, remediation advice, Actions Kanban board, ignore/resolve controls, KEV and EPSS prioritisation

- Reporting: PDF summary reports (all tiers); XLSX risk/action exports, DOCX web presence reports and custom DOCX reporting (Premium/Enterprise)

- Data exports: CSV exports for domains, IPs, services and risks (Enterprise)

Hexiosec ASM ships with an open, documented API (Enterprise), so discovered assets, risks and actions can be pulled directly into your existing SIEM, ticketing or GRC tooling rather than living only in the ASM dashboard.

Enterprise plans also support SSO integration, including Microsoft Entra and Auth0, and a Cloud Connector for discovering assets across your cloud accounts alongside your public-facing estate.

On the security and compliance side, Hexiosec is UK-hosted and UK-operated by default - a meaningful distinction from US-headquartered EASM platforms for organisations with data residency or sovereignty requirements. The platform supports multi-factor authentication on all tiers, granular user access permissions, and was independently validated by the NCSC as part of its ACD 2.0 trials.

Hexiosec ASM is built for security-conscious IT and security teams at organisations of any size. From small teams needing an accurate first picture of their exposure, through to enterprises and MSPs managing continuous monitoring across their own estate and a supply chain of third parties. A free-forever tier (no credit card required) is available for teams getting started; Premium and Enterprise plans add depth, scale, API access and dedicated support.