Every European attack surface management and security rating reviewed
London, United Kingdom
Not published; a free cyber risk trial is offered
Free cyber risk trial
Best for: Risk and procurement teams that need scores for suppliers as well as their own estate
Orpheus Cyber issues cyber risk scores per organisation and monitors both your own external attack surface and the surfaces of your third parties, which it shows in a supplier heat map. The same portal adds shadow IT discovery, a security questionnaire module and a vulnerability score called OVSS, which the vendor says updates in real time using machine learning. A free cyber risk trial lets a team load real suppliers before buying.
The operating company is Orpheus Cyber Limited, registered in England and Wales under number 10499131 with an office at 34 Lime Street, London, and its website terms are governed by English law.
The homepage says its scores were validated by Gallagher Re as predictive of cyber claims, a vendor statement we did not test. Pricing is not published, the hosting region is not stated on the pages checked, and its supplier coverage should be tested against the long tail of your own vendors.
What Orpheus Cyber does well
- Scores for own organisation and third parties
- Free cyber risk trial
- Regulatory mapping for DORA, NIS2 and ISO 27001
- Vulnerability prioritisation with its own score
- UK-incorporated vendor with English-law terms
Where Orpheus Cyber falls short
- No public pricing
- Hosting region not stated on the pages checked
- Scoring accuracy claim is vendor-reported
- Smaller supplier coverage than the large US vendors is likely
Standout feature. Orpheus Cyber is the one vendor on this list that produces a supplier-facing risk score and an own-estate attack surface view in the same portal.
Paris area, France
Quote only: Essential, Core and Elite packages
Demo on request
Best for: Security teams that want daily outside-in monitoring with analyst support
CybelAngel looks at what sits outside your network: forgotten assets, exposed file servers, leaked credentials, look-alike domains and dark web mentions. Its pricing page says every package covers the full external attack surface and scans it daily. Essential is self-service, Core adds enriched analysis, on-demand active testing and a customer success manager, and Elite adds predictive threat intelligence and a dedicated analyst.
According to its terms CybelAngel is a French SAS with EUR 150,000 of capital, entered in the Paris register as 791 341 274, and Be Api hosts the website in Paris. Takedown support covers domains and file servers, and the vendor also sells risk analysis for M&A, third parties and VIPs. Pricing is quote only and the platform hosting region is not stated, while supplier scoring in the style of a rating exists only as services in the higher packages.
What CybelAngel does well
- Daily scanning on every package
- Credential, domain and dark web monitoring in one product
- Analyst-supported tiers
- Takedown services
- French SAS with published company number
Where CybelAngel falls short
- Quote-only pricing
- Hosting region not stated on the pages checked
- Supplier scoring only in higher tiers
- Broad scope can be more than an ASM-only buyer needs
Standout feature. CybelAngel pairs daily scanning with takedown services, so a leaked credential or a fake domain can be removed and not only reported.
Netherlands
Atlas priced on total asset count (quote); Nova pentests from EUR 1,250 per test excluding VAT
Free external scan
Best for: Teams that want findings proven exploitable instead of long scanner lists
Hadrian divides its offer into Atlas, which maps the external attack surface continuously and tests every change it detects, and Nova, which runs pentests with AI agents on demand. The vendor says only validated exposures trigger notifications. Add-ons cover mergers and acquisitions assessments and detection of credentials leaked by infostealers, and results map to DORA, NIS2, SOC 2 and ISO 27001.
The contracting party in the terms is Hadrian Security B.V., a Dutch private limited company, and the order form can set English or New York law instead.
Nova pentests start at EUR 1,250 per test excluding VAT, with bundles, while Atlas is priced on total asset count on request and a free external scan is offered to start. Hadrian does not issue supplier security ratings, and its claims about agentic testing depth are the vendor's own and were not independently checked.
What Hadrian does well
- Findings validated before alerting
- Per-test pentest price published
- Clear DORA and NIS2 mapping
- Free external scan to start
- Dutch B.V. as contracting entity
Where Hadrian falls short
- No supplier ratings
- Atlas pricing on request
- Order form can set non-EU governing law
- Agentic testing claims are vendor-stated
Standout feature. Hadrian is the only vendor here that lists a per-test pentest price next to a continuous attack surface product.
Cléder, France
Custom pricing, contact sales for each view
Demo on request
Best for: Analysts and security teams that want raw scan data and domain-based asset discovery
ONYPHE builds on its own scans of the whole Internet, run weekly, and sells the result in tiered views. The homepage states 20 billion or more banners collected monthly, 10 billion or more DNS entries monthly and more than 5,000 ports scanned weekly. The ASM Edition adds asset tracking and alerts, Vulnscan checks more than 190 actively exploited CVEs, and larger views keep up to 48 months of history.
ONYPHE SAS is named in the legal notices, based in Cléder, France, with Patrice Auffret as president, and OVH hosts its website in France. Prices are custom for every view and the pricing pages state a rate limit of about one request per second. There is no supplier score, and analysts have to write queries in OQL and build their own workflows, so this suits teams with threat intelligence skills more than a general IT department.
What ONYPHE does well
- Internet-wide scan data refreshed weekly
- Domain-based asset discovery
- History up to 48 months on larger views
- API access
- French SAS with published registration
Where ONYPHE falls short
- No public prices
- No supplier security score
- Rate limit of about one request per second
- Analyst skills needed to use it fully
Standout feature. ONYPHE is the only vendor here whose product starts from its own whole-Internet scan data and exposes it through a query language and an API.
London, England
Free plan; Cloud, Pro and Enterprise by quote or checkout; AI pentests from USD 3,500 per test
Free plan; 14-day trial on the Cloud plan
Best for: Small and mid-sized teams that want hands-off monitoring of what they expose
Intruder joins attack surface monitoring, external and internal vulnerability scanning, cloud checks, container image scanning and DAST in one subscription. The pricing page lists a Free plan with weekly external scans, one cloud account, two container images and three users, a Cloud plan with a 14-day trial, a Pro plan and a quote-based Enterprise plan. Change detection scans new assets when ports open or cloud services appear.
The company is Intruder Systems Ltd, registered in England with company number 09529593 according to its footer, and the homepage claims more than 3,000 companies use the product, a vendor figure.
The free plan is limited to ports 80 and 443, internal scanning needs agents, and amounts for paid plans were not visible in the page text, while AI pentests are priced in US dollars. Intruder is a scanner and monitor, so it gives a hygiene score for your own assets and no supplier ratings.
What Intruder does well
- Free plan available
- 14-day trial on the Cloud plan
- Change detection for new assets
- Many integrations
- UK Ltd with published company number
Where Intruder falls short
- No supplier ratings
- Paid plan prices not in page text
- Pentests priced in US dollars
- Free plan limited to ports 80 and 443
Standout feature. Intruder offers a Free plan that covers three users with weekly external scans, the lowest barrier to entry on this list.
Stockholm, Sweden
Founded 2013
Starter free (up to 5 users, 100 assets) / Standard €2,500 / Professional €5,000 / Enterprise €15,000 per year
Free Starter tier; tailored trials for paid plans
Best for: Security teams whose exposure is mostly web applications and APIs and who want published annual prices
Detectify combines external attack surface mapping with dynamic application security testing. Test payloads are written by its research staff and by Crowdsource contributors, over 400 outside hackers who submit working techniques. Standard adds REST and GraphQL API scanning, while a place in a build pipeline needs Professional.
Detectify AB operates from Stockholm, which puts the reports it builds about your infrastructure under Swedish and EU law, and the tool page lists ISO 27001 and GDPR. The price list is public, with four steps: a free Starter tier, then EUR 2,500, EUR 5,000 and EUR 15,000 a year. Detectify dates from 2013, reports exposure without stopping any traffic, and Standard stops at 750 assets and 10 users.
What Detectify does well
- External attack surface management plus DAST in one platform
- Crowdsource payloads from 400+ ethical hackers
- REST and GraphQL API scanning
- Published pricing from a free tier to €15,000/year
- Swedish company, EU jurisdiction
Where Detectify falls short
- Finds vulnerabilities rather than blocking attacks, not a WAF or CDN
- Standard tier caps at 750 assets and 10 users
- CI/CD integration reserved for Professional and above
- Enterprise pricing jumps sharply to €15,000/year
Standout feature. Detectify publishes annual prices for every tier, which almost no application security vendor does.
Geneva, Switzerland
Founded 2019
Free Community Edition; paid AI Platform (penetration testing, ASM, dark web monitoring) quoted by sales
Free Community Edition, unlimited use
Best for: Teams that want human-verified penetration testing with AI acceleration, plus a free first look
ImmuniWeb has human penetration testers work with AI models tuned for application testing, and packages testing, discovery of exposed assets and dark web monitoring as a single suite. The tool page lists CREST accreditation, among it the newer one for AI-enabled testing, and ISO 9001:2015. Its free Community Edition is aimed at small organisations and says it runs over 100,000 tests daily.
The Geneva company ImmuniWeb SA dates its independence to 2019, calls itself self-funded and profitable, and gives Geneva as the data location. Because Swiss law is recognised by an adequacy decision and the country is not in the EEA, note it in your transfer file. The AI Platform needs a quote, and the free edition does less than a paid engagement.
What ImmuniWeb does well
- Human penetration testers with CREST-accredited AI assistance
- Penetration testing, ASM and dark web monitoring combined
- Free Community Edition runs 100,000+ tests daily
- Self-funded and profitable, no outside investor pressure
- ISO 9001:2015 certified
Where ImmuniWeb falls short
- Paid platform pricing not published
- Switzerland: adequacy decision, not EU/EEA jurisdiction
- Free tier is lighter than the paid testing service
- Sales conversation required to evaluate real cost
Standout feature. ImmuniWeb is accredited by CREST for AI-enabled penetration testing, an external audit and not a marketing claim.
Dublin, Ireland
Founded 2017
See website; no prices on the pages checked
Demo on request
Best for: Organisations that want automated testing with expert verification of findings
Edgescan describes a continuous security testing and exposure management platform, founded in 2017 by Eoin Keary with offices in Dublin and New York. The attack surface management module sits beside web, API, network and mobile testing and pentest as a service. The vendor says it combines vulnerability intelligence with human verification, aimed at reducing false positives.
The privacy policy names BCC Risk Advisory Limited, an Irish company, trading as Edgescan, under company number 497804. That policy covers the website, and the entity used for service contracts was not checked, which matters because the vendor also has a US office. No prices appeared on the pages checked and there is no supplier rating.
What Edgescan does well
- Attack surface plus testing in one platform
- Human verification of findings
- Pentest as a service
- Irish company with registration number
- Dublin base
Where Edgescan falls short
- No public prices
- No supplier ratings
- US office alongside Dublin
- Service contract entity not checked
Standout feature. Edgescan places human verification of results inside the same platform as its attack surface module.
Karlskrona, Sweden
Quote; Outscan NX is an annual subscription priced by asset count
Demo on request
Best for: Larger organisations that want a Swedish vulnerability and exposure vendor
Outpost24 sells external attack surface management for internet-facing assets and shadow IT alongside Outscan NX, a risk-based vulnerability management service for networks and cloud. Outscan NX uses threat intelligence and machine learning to estimate the likelihood of exploitation. The vendor states more than 2,500 customers in over 80 countries, a figure we did not verify.
The company is Outpost24 AB, number 556615-2103, based in Karlskrona, Sweden. Its site blocked automated fetches, so the entity and product facts here come from search results of its own pages and its service terms, not from pages opened directly. Outscan NX is an annual subscription priced by asset count with overage billed monthly, no other price is published, and the vendor offers no supplier ratings.
What Outpost24 does well
- EASM and vulnerability management in one vendor
- Published service-specific terms
- Priced by asset count for Outscan NX
- Swedish AB with registration number
Where Outpost24 falls short
- No public prices
- No supplier ratings
- Vendor site blocked automated checks
- Aimed at larger buyers
Standout feature. Outpost24 publishes service-specific contract terms, including a DORA appendix, ahead of any sales conversation.
Tel Aviv, Israel
See website; plan tiers are listed without prices
Demo on request
Best for: Teams that already use Check Point or want attack surface and dark web monitoring in one platform
Check Point Exposure Management is the product formerly known as Cyberint, and the cyberint.com site now says Cyberint is a Check Point company. It bundles attack surface management with deep and dark web monitoring, brand protection, global threat intelligence and a supply chain module that detects the vendors you use and alerts on high risks. The pricing page compares tiers by module and adds remediation credits for takedowns.
The Check Point licence agreement names Check Point Software Technologies Ltd of Tel Aviv, Israel, which counts as European on this directory. Check Point also lists Cyberint Inc. among its US subsidiaries in its privacy policy, so the contracting entity for this product was not confirmed and must be read in the order form. The product is no longer independent, and no prices are shown.
What Check Point Exposure Management (Cyberint) does well
- Attack surface, dark web and brand monitoring combined
- Supply chain module
- Tiers compared on the pricing page
- Backed by an Israeli parent
Where Check Point Exposure Management (Cyberint) falls short
- Contracting entity needs confirming
- No prices
- No longer independent
- US subsidiary exists
Standout feature. Check Point Exposure Management is the only listed product backed by a large security vendor, with a supply chain module for supplier alerts.
