External Attack Surface Management: A UK Buyer's Guide for SMEs and MSPs

What is external attack surface management?

External attack surface management is the continuous discovery and monitoring of everything your organisation exposes to the public internet. Your attack surface is the set of points where an attacker can interact with you: apex domains and subdomains, IP addresses and the services listening on them, web applications and admin panels, TLS certificates, and the DNS records that govern your email. EASM builds that list and then keeps checking it.

The word doing the work is discovery. A tool that scans a list you typed in is a scanner. EASM is expected to start from your organisation's public identity -- a domain, a company name, a certificate footprint -- and work outwards to find the staging site nobody decommissioned, the marketing microsite a supplier set up, the router web interface exposed when a firewall rule was changed for a weekend and never changed back. For most UK SMEs the first discovery run is the single most valuable output of the whole exercise, because it is the first time anyone has seen the estate in full.

Everything is done from the outside. No agent on a server, no credentials, no firewall exception, no access to anything internal. That is a capability limit and also the reason EASM is deployable by a small team in an afternoon.

What does a UK SME or MSP actually need?

Enterprise EASM requirement lists are written for organisations with a security team. A UK business of 20 to 200 people, or an MSP carrying thirty such businesses, has a different constraint: whoever operates this tool has another job. That narrows what matters to four things.

1. Discovery at the tier you will actually buy

Entry tiers are where discovery quietly goes missing. Check the plan you are being quoted, not the capability page. The test to apply during a trial: how many assets did it find that were not on your list? If the answer is zero, either your documentation is unusually good or the discovery is not working.

That figure is the argument for looking at all. It is not an argument for any particular vendor: any competent external scan across a cohort of UK SMEs would surface a similar picture, which is rather the point.

2. Output a generalist can act on

A finding that reads "CVE-2023-48795, CVSS 5.9, see advisory" is a research task. A finding that reads "this SSH service accepts a vulnerable key-exchange configuration; update OpenSSH to 9.6 or later, or disable the affected ciphers in sshd_config" is a change request. Same underlying detection, entirely different cost to your Tuesday. Ask to see real findings during the demo and read the remediation field, not the severity badge.

3. No agents, no credentials, no project

External-only scanning should mean you prove you own a domain (usually with a DNS TXT record) and results start arriving. Anything that requires software on servers, a credentialed scanner inside the network, or a paid onboarding engagement has a deployment cost that small teams routinely underestimate and then never finish paying.

4. A price you can put in next year's budget

This is the requirement most often left off the list, and the one that most often ends an EASM subscription in month nine. If the bill is metered by discovered assets, doing the thing you bought the tool for makes the tool more expensive. That is a structural conflict, not a criticism of any particular vendor -- but you should know which model you are signing up to. See the four pricing models below.

And for MSPs specifically

Add three requirements: separate tenants per client under one login, per-client reporting you can send without editing, and a commercial arrangement that lets you include the service in a managed offering rather than reselling a licence at cost. An EASM tool that cannot separate clients is an EASM tool you will operate in spreadsheets.

What should a UK buyer check specifically?

Data residency and processing

Scan output is a map of your weaknesses, so treat it as sensitive whether or not it contains personal data. Ask where findings are stored and processed, what the transfer mechanism is if that is outside the UK or EEA, and for the sub-processor list. Under UK GDPR you need a lawful basis for transfers and a data processing agreement with anyone handling data on your behalf; if you serve public-sector or regulated clients, their own supplier questionnaires will ask you these questions and you will need the vendor's written answers, not your recollection of a sales call.

Cyber Essentials and Cyber Essentials Plus

Cyber Essentials, the UK government-backed scheme administered by IASME, is a self-assessment covering five control areas, with Cyber Essentials Plus adding independent technical verification. Several of those controls are about exactly what an external scan sees: services exposed to the internet that need not be, software reachable from the internet that is unsupported or unpatched, and default or weak configuration on public-facing systems. Running an external scan before you submit means you find those things before an assessor does, and a dated export gives you something to attach to the remediation you did.

Be clear about the limits. No EASM vendor certifies anyone -- certification comes from an IASME-appointed certification body -- and the scheme's scope includes things an external scan cannot see, such as user access control and malware protection on endpoints. Treat EASM as evidence-gathering and gap-finding for the external half. Our Cyber Essentials preparation page goes through which controls an external view can and cannot help with.

NIS2 and the UK NIS Regulations

Most UK SMEs are not directly in scope of either, and you should establish which side of that line you are on before letting a vendor use the acronyms as a closing argument. The UK NIS Regulations apply to operators of essential services and relevant digital service providers under UK competent authorities; the EU's NIS2 Directive applies to in-scope entities in EU member states, which can reach a UK company through an EU establishment or, more commonly, in practice through a customer's supply-chain requirements flowing down to you. Both frameworks expect risk management measures and vulnerability handling, so a documented external monitoring process is genuinely useful when you are in scope or being asked about it. Neither makes a specific tool mandatory, and any vendor saying otherwise is telling you something about their sales training.

Procurement through an MSP

For many UK SMEs the right answer is not to buy an EASM licence at all, but to require the outcome from the IT provider they already pay. An MSP running one platform across its client base has both the volume economics and, crucially, someone who will actually read the findings. If you go that way, get four things in the service schedule: which platform, the scan frequency, a written monthly report to you, and who is accountable for remediating what is found. If you are the MSP, the questions in the vendor table apply with multi-tenancy and per-client reporting weighted far higher, and our MSP page sets out how we handle that side.

Which tools should a UK SME shortlist?

Three or four is the right shortlist length, chosen to span pricing models rather than to collect logos. The products below are the ones UK small businesses and MSPs most often encounter, described neutrally; each link goes to a detailed comparison, and the roundup of EASM tools for small businesses covers a wider field.

• Intruder -- an established UK-founded platform with a well-regarded interface and a genuinely useful free plan for a first look. Pricing is a base fee plus per-target licences, so model the target count carefully.
• Attaxion -- discovery-first, with clearly published per-asset tiers and a 30-day full trial. Strong on the capability that matters most; the trade-off is that the bill tracks the asset count.
• Detectify -- deep application-layer testing built on crowdsourced research, and the strongest option here if your primary risk is a web application you build yourself. Annual platform fees plus usage put it above most SME budgets.
• UpGuard -- external security ratings with substantial third-party and vendor-risk monitoring attached. Worth shortlisting if you need to assess your suppliers as well as yourself.
• Microsoft Defender EASM -- the natural candidate if you are already committed to Azure and have someone comfortable there. Billed per billable asset through Azure, with a 30-day trial, and it expects more security familiarity than the others.
• SurfaceLoop -- our own product, included here for completeness: one flat £149/mo with discovery included, plain-English remediation, a 14-day trial with no card, invoiced by AMVIA. It is aimed squarely at the flat-price, small-team case and does less than the enterprise platforms above by design.

How do you run a two-week evaluation?

1. Before you start, write your list. Every domain and public IP you believe you own, from memory and from your registrar. This is the baseline the trial is measured against, and it must be written down before discovery runs.
2. Set the weights. Take the rubric above, adjust the weights for your situation, and agree them with whoever signs the invoice. Doing this after the demos is how shortlists get rationalised backwards.
3. Run two or three trials in parallel on the same domains. Parallel, not sequential: the comparison is only meaningful against the same estate in the same fortnight.
4. Count the delta. How many assets did each tool find that were not on your list, and did it find any the others missed? This is the single most informative number in the exercise.
5. Fix three findings using only the tool's own words. One header or DNS issue, one certificate or service issue, one software or version issue. If you had to search elsewhere to understand what to do, score the output criterion accordingly.
6. Get the quote at the discovered count. Then ask for the same quote at 50% more assets, and for the renewal price. Metered models deserve both figures in writing.
7. Score, then decide. Fill in the rubric from observed evidence, note where you overrode a score and why, and keep the sheet. It is the document that makes the renewal conversation straightforward in a year.

Published 24 September 2026 · Last updated 24 September 2026 · Written by Nathan Hill-Haimes, co-founder of AMVIA and SurfaceLoop. Competitor pricing was taken from each vendor's published pricing information and is stated as of September 2026; prices and plan structures change, so confirm current figures with the vendor. First-party statistics are drawn from the UK SME External Exposure Snapshot, September 2026, whose methodology is public. This guide may be quoted with attribution to SurfaceLoop.