zcrCTEM vs Cortex Xpanse vs Mandiant ASM vs Falcon Surface — Which CTEM/EASM Platform Actually Fits a Thai Enterprise
Compare zcrCTEM with Cortex Xpanse, Mandiant ASM, and Falcon Surface on pricing, asset discovery, PDPA compliance, and MSSP support, with a comparison table.
zcrCTEM vs Cortex Xpanse vs Mandiant ASM vs Falcon Surface — Which CTEM/EASM Platform Actually Fits a Thai Enterprise
Picture this: you're the CISO, and the board asks a deceptively simple question — "What assets do we actually have exposed to the internet, and which ones are the riskiest?" It sounds like something you should be able to answer in thirty seconds. Try it for real, though, and you'll usually find nobody on the team has the full picture. Marketing spun up a subdomain through some SaaS tool without telling anyone. A dev left a test API open after a deploy. And there's that one OT server security treats as a black box because it isn't "real IT."
That gap is exactly what CTEM (Continuous Threat Exposure Management) and EASM (External Attack Surface Management) exist to close — and it's a market big enough that Palo Alto Networks, Google Cloud/Mandiant, and CrowdStrike all went shopping for acquisitions to build it out between 2020 and 2022. This article puts zcrCTEM head-to-head with all three: Cortex Xpanse (Palo Alto Networks), Google/Mandiant Attack Surface Management, and CrowdStrike Falcon Surface — using only facts we can actually verify, without guessing at undisclosed competitor pricing, and without pretending zcrCTEM wins on every axis. All three of these companies bring real strengths that come from being backed by parent companies many times zcr's size, and that's worth saying plainly rather than around.
What CTEM/EASM actually means, and why Thai companies are talking about it more
If the concept is new to you, our guide to what CTEM is walks through Gartner's five-stage framework in detail, and our piece on external attack surface zooms in specifically on the discovery stage — how shadow IT, forgotten domains, and exposed APIs quietly turn into real vulnerabilities.
Short version: EASM is the process of scanning for every asset the outside world can see that belongs to your organization. CTEM is the bigger process framework around it — taking what EASM finds and prioritizing it by actual business impact, on a continuous loop rather than a one-time scan. All four vendors compared here operate in this same space; they just come from very different starting points.
What zcrCTEM is
zcrCTEM (Continuous Threat Exposure Management) puts three jobs into one console, with data scoped per tenant: EASM maps what you expose to the internet, CAASM shows which internal and cloud assets your security tools actually cover, and DRP tracks dark web findings and brand impersonation. It scores and prioritizes what it finds, and when AI drafts a ticket or a takedown, nothing happens until an analyst approves it.
We went through the public demo (no login, link at the end of this article) and checked each point below against a real screen. The demo runs on sample data, so this describes what the product does and leaves the on-screen numbers out:
- Findings with a risk score and EPSS — every EASM finding (vulnerabilities, certificates, open ports) carries a 0–100 risk score, and findings tied to a CVE show EPSS. Open one and you see the detected ports, redacted evidence and an investigation path before you turn it into a ticket.
- Priority tiers set by the business — domains go into tiers such as crown jewels, kept separate from technical severity, so a high on a test server and a medium on the payment portal don't get queued the same way.
- CAASM coverage gaps — one inventory merged from connected tools shows, per asset, whether EDR, vulnerability scanning and cloud posture coverage is present, missing or not yet confirmed. Sync Health warns when a source disconnects or stops reporting, so a blind spot doesn't pass for a clean result.
- Dark web threat intelligence — findings for leaked credentials, stealer logs, ransomware leak-site posts and exposed source code, each with a confidence score that shows which evidence was checked and what's still missing, mapped to MITRE ATT&CK and matched against your EASM inventory.
- Takedowns under policy — look-alike domains, fake mobile apps and messaging channels exposing your organization become incident cases, and a protected-asset policy decides whether a takedown is allowed and how many approvers it needs.
- AI proposes, an analyst decides — agentic workflows and an AI assistant draft tickets and takedowns, but every draft waits in the Audit trail for someone to approve or reject it, recorded with the template and version that produced it.
The Integrations page groups data sources into EASM, CAASM and dark web feeds. EASM discovery starts from the root domains you enter and draws on Certificate Transparency logs, Passive DNS, Censys, Shodan, DNSdumpster, BinaryEdge, Netlas, DNS brute-force resolution and zcr's own built-in discovery engine, with a sync cadence set per source. CAASM pulls asset and coverage data from security tools such as Microsoft Defender, Tenable.io and CrowdStrike. Connectors for AWS Security Hub, Qualys, SentinelOne and Okta are marked "Coming soon" in the demo, so don't plan around them yet. zcr doesn't publish a connector count.
On compliance, know this up front: it isn't in the public demo. PDPA and CII readiness, breach notification drafts for PDPA's 72-hour window and AI-generated compliance reports sit in zcrCTEM's separately priced AI & Compliance module, and zcr will walk you through that part on request.
Discovery setup has its own Scope & Discovery page: seed domains with bulk import, include/exclude rules by subdomain, CIDR or ASN, a log of who changed the scope, and the list of sources the next sync runs against. Cadence is set per source in Integrations, so if your organization needs a guaranteed scan interval, get it in writing from your channel partner rather than reading it off the demo.
On deployment, zcrCTEM runs as SaaS, with data scoped per tenant. For EASM that's the natural shape anyway, since it needs an outside-in vantage point to see what an attacker actually sees. All three competitors below are pure SaaS too.
Cortex Xpanse (Palo Alto Networks) — internet-scale scanning, tightly wired into the Cortex platform
Cortex Xpanse has an interesting origin story. It started life as Qadium, founded in 2012 by a team with roots in DARPA-funded research at Stanford, before renaming to Expanse Inc. in October 2018 and being acquired by Palo Alto Networks — announced November 2020, closed December 15, 2020, for roughly $800 million ($434.9 million in cash, $340.7 million in stock, plus $21.6 million in replacement equity, per Palo Alto Networks' SEC filing).
Xpanse's clearest, most verifiable strength is internet scanning scale — Palo Alto states it scans more than 500 billion ports per day across over 4.3 billion IPv4 addresses. That's raw scanning throughput, a different unit from a count of data sources. Still, it does reflect a real advantage in sheer scale of internet-wide visibility that comes from being part of a global-scale company.
Another clear edge for Xpanse is how deeply it plugs into the rest of the Cortex platform — findings flow straight into Cortex XSIAM and Cortex Data Lake, giving teams already on Cortex a genuine single-pane view of "outside-in plus inside-out," and letting them pull automated playbooks from Cortex XSOAR to respond to findings directly. That integration is arguably the whole reason Palo Alto acquired Expanse in the first place.
On pricing, Palo Alto doesn't publish a public price — you have to talk to sales. Third-party estimates (not vendor-published figures) put it around $95,000/year for up to 999 assets with basic support, per eSecurityPlanet. Again, this is a third-party benchmark, not numbers Palo Alto has published itself.
On deployment, Xpanse is pure SaaS, part of the Cortex platform, which offers regional hosting in parts of Asia — but we found no confirmation that this hosting is Xpanse-specific, nor of Thailand-specific data residency or Thai-language support. Palo Alto Networks does have a real Bangkok office (Mitrtown Office Tower), but that's the company generally — nothing Xpanse-specific was confirmed on that front.
Google Cloud / Mandiant Attack Surface Management — the deepest published discovery numbers in this group, and a proven threat intel track record
Mandiant built nearly two decades of incident response and forensics history before Google Cloud announced its acquisition on March 8, 2022, at $23.00/share (roughly $5.4 billion total, all cash). The deal cleared DOJ review in July 2022 and closed on September 12, 2022, bringing over 300 threat intelligence researchers/analysts and more than 600 security consultants under Google Cloud.
Of the three competitors compared here, Mandiant publishes the most detailed discovery-breadth numbers. It claims to cross-check data from 250+ sources (including Mandiant Threat Intelligence, NIST NVD, the CISA KEV catalog, and Mandiant's own custom content) and run 350+ active checks for known CVEs and misconfigurations. zcr doesn't publish a source or connector count for zcrCTEM at all, so on disclosed discovery breadth Mandiant is simply ahead — it's the only vendor in this comparison that puts a data-source number on the table.
Mandiant's most impressive and most verifiable strength is response speed to new threats. When Log4Shell (CVE-2021-44228) broke on December 9, 2021, Mandiant had an active check live the very next day, December 10, and expanded coverage further within three days. That's a concrete example of how nearly 20 years of threat intelligence and IR pedigree — built up long before Google's acquisition — translates into real product speed.
On pricing, there's no public price list, and Google's product page sends you to sales for both pricing and a trial (not an open browse-anytime demo like zcrCTEM's). The best third-party figure available is an average Mandiant software spend of around $83,000/year — but that's an average across Mandiant's entire product line, not an ASM-specific price, and not a number Google has published.
On deployment, it's part of the Mandiant Advantage platform and switches on automatically when a customer enables Google Security Command Center (SCC) at the Enterprise tier — pure SaaS as well. Google Cloud's Thailand (Bangkok) region has been live since January 21, 2026, but we couldn't confirm whether Mandiant ASM specifically uses it — that point remains unconfirmed. We also found no direct evidence of Thai-language support for Mandiant.
CrowdStrike Falcon Surface — a Falcon platform add-on that's strongest on adversary-intelligence-linked prioritization
Falcon Surface traces back to CrowdStrike's acquisition of Reposify Ltd., an Israeli/San Francisco-based EASM company founded in 2017 with roughly 22 employees at the time of acquisition. The deal was announced at Fal.Con in September 2022 (terms undisclosed), and the product launched as "Falcon Surface" on December 15, 2022. Worth clearing up a common mix-up: this is a separate product from Falcon Intelligence Recon, CrowdStrike's own dark-web/criminal-forum monitoring product — not an earlier name for Falcon Surface, despite what some sources suggest.
Falcon Surface's main selling point is how it ties into CrowdStrike's own adversary-tracking data — each finding gets an "automated prioritization metric" calculated from industry, CVE score, geography, known adversary group attack history, and asset type. That's a genuine differentiator tied to CrowdStrike's threat intelligence brand, not just marketing language.
On discovery scale, CrowdStrike's own datasheet states its mapper indexes over 7 billion exposed assets globally per year, with up to 140 million identified per week — both figures come from the same CrowdStrike-published source. We found no data-source/connector count disclosed by CrowdStrike in the same format Mandiant or zcrCTEM publish — CrowdStrike describes its methodology as "internet-wide domain-based scanning" rather than counting connectors.
On pricing, Falcon Surface sells as an add-on module on the Falcon platform, priced per-endpoint rather than per-asset like the first two competitors. There's no public price; third-party estimates that bundle the Falcon platform, exposure management, and managed services together land around $200–400/endpoint/year at 1,000-endpoint scale — a platform-wide estimate, not a Falcon Surface-specific price.
On deployment, it's pure SaaS and agentless (no Falcon agent needs to be installed on discovered assets). Regionally, CrowdStrike has held its APJ Partner Symposium in Bangkok and has real Thai partners delivering the Falcon platform, but that's about the Falcon platform broadly, not Falcon Surface specifically — we found no confirmation of Thai-language support or Thailand data residency for Falcon Surface itself.
Analyst recognition — an honest "we can't confirm this yet"
Gartner published its first-ever Magic Quadrant for "Exposure Assessment Platforms" (EAP) in November 2025, covering 20 vendors — this is a new research category, not a folded-in successor to some earlier dedicated EASM Magic Quadrant. In this research pass, we could confirm XM Cyber's position (Challenger), but not where Cortex Xpanse, Mandiant ASM, or Falcon Surface land in the new MQ. The full MQ report sits behind a paywall we couldn't access for this research. If you need to cite any of these vendors' EAP MQ positioning, check the actual report first — don't take this article or any secondary source as gospel.
Separately, we can confirm CrowdStrike has held a Leader position for multiple consecutive years in Gartner's Endpoint Protection Platforms MQ, and also holds a position in the Cyberthreat Intelligence MQ — but those are different categories from EASM/CTEM entirely, and shouldn't be read as evidence that Falcon Surface also has an EAP MQ position.
Comparison table
| zcrCTEM | Cortex Xpanse | Mandiant ASM | Falcon Surface |
|---|
| Deployment | SaaS, multi-tenant | SaaS | SaaS (part of Mandiant Advantage / Google SCC Enterprise) | SaaS (add-on module on the Falcon platform) |
| Pricing | Publicly listed, 4 modules priced independently from ฿10,600/month (EASM, CAASM, DRP + Dark Web, AI & Compliance — setup/config/training included) | Contact sales only — third-party benchmark ~$95,000/year (<1,000 assets) | Contact sales only — third-party benchmark ~$83,000/year (average across all Mandiant products, not ASM-specific) | Contact sales only — third-party benchmark ~$200–400/endpoint/year (whole-platform estimate) |
| Published discovery breadth | No count published — names its EASM sources (CT logs, Passive DNS, Censys, Shodan and others) and CAASM connectors | 500B ports/day scanned across 4.3B IPv4 addresses (measured by scan throughput) | 250+ data sources, 350+ active checks (the only source count published in this group) | Up to 140M assets identified/week (measured by assets found, not sources) — no disclosed source/connector count |
| PDPA compliance reporting | AI & Compliance module (PDPA/CII readiness, breach notification drafts), priced separately and not in the public demo | No PDPA-specific data found | No PDPA-specific data found | No PDPA-specific data found |
| Multi-tenant / MSSP | Data scoped per tenant, tenant switcher, SSO per tenant (OIDC/SAML) | No direct comparison data found | No direct comparison data found | No direct comparison data found |
| Analyst recognition (2025 EAP MQ) | No data yet (product is much newer) | Not confirmed in this research | Not confirmed in this research | Not confirmed in this research |
| Standout strength | Published per-module pricing + analyst approval on every AI-drafted action + CAASM coverage gaps + PDPA/CII compliance module | Internet-wide scanning scale + tight Cortex XSIAM/XSOAR integration | Breadth of data sources (250+) + proven threat intel/IR pedigree (1-day Log4Shell response) | Prioritization tied directly to CrowdStrike's own adversary intelligence |
The discovery-breadth numbers in this table measure different things and shouldn't be read as a direct ratio — Xpanse measures raw scanning throughput, Falcon Surface measures assets found, and Mandiant measures data sources. All three competitors' pricing figures are third-party benchmarks, not vendor-published prices — unlike zcrCTEM's published per-module ladder, which starts at ฿10,600/month and is real pricing on the website, not a third-party estimate.
Curious what that starting price actually covers for your organization?
See zcrCTEM pricing →
So which one should your organization actually pick
Honestly, there's no single right answer for everyone.
If your organization already runs Cortex XSIAM/XSOAR and wants a genuine "outside-in plus inside-out" view in one platform, with an enterprise-level budget to match, Cortex Xpanse is the strongest fit — the depth of integration within the Cortex family is something zcrCTEM simply can't match at the same level.
If threat intelligence pedigree and breadth of data sources are your top priority — especially if you're already on Google Cloud Security Command Center — Mandiant ASM has the widest verifiable disclosed data in this group, backed by a real, proven fast-response track record (Log4Shell).
If your organization has already invested in CrowdStrike Falcon as the backbone of endpoint security and wants prioritization tied directly to CrowdStrike's own adversary data, Falcon Surface is a sensible extension of what you already have.
As for zcrCTEM, it's the better fit for Thai organizations that want pricing they can check before ever talking to a salesperson (no multi-round "contact sales" dance like the three above), want AI to draft the work but a person to sign off on every ticket and takedown, need to see which assets their EDR and scanners are missing, want PDPA/CII compliance reporting from the same vendor, need a support team that speaks Thai directly, or run an MSSP model managing multiple clients at once.
To be fair about it: zcrCTEM doesn't have anywhere near the track record of these three, has no position in any global analyst report to point to, and trails Mandiant on published discovery breadth. What it does offer right now, verifiably, isn't a numbers game: a price you can read on the website, a console where AI drafts the work but analysts make the call, and a public demo you can check all of this against.
Try the zcrCTEM demo yourself
The zcrCTEM demo lives at https://demo.zcrctem.zcr.ai — it's a genuinely open public demo, no login required, unlike Mandiant, Xpanse and Falcon Surface, whose product pages route live-demo requests through a sales team. It runs on sample data, so judge the workflow rather than the numbers: open a finding, check Coverage & Gaps, then approve or reject an AI proposal in the Audit trail. The AI & Compliance module isn't in the demo; ask zcr to walk you through that part.
If your organization cares about digital risk protection beyond asset discovery — leaked credentials on the dark web, brand-impersonating fake websites — our Dark Web Monitoring article covers Digital Risk Protection (DRP) in detail, which zcrCTEM handles in its DRP module.
Frequently asked questions
How much does zcrCTEM cost?
zcrCTEM is priced per module, not as one flat number. External attack surface discovery (EASM), cloud/internal asset inventory (CAASM), and AI & Compliance all start at ฿10,600/month, and digital risk protection (DRP + Dark Web) starts at ฿21,300/month — each scales with real usage (assets, monitored keywords, or headcount), not company size, with setup, configuration, and training included. The full published ladder for all 4 modules is on the pricing page.
What sources does zcrCTEM discover assets from?
EASM discovery starts from your own seed domains and uses Certificate Transparency logs, Passive DNS, Censys, Shodan, DNSdumpster, BinaryEdge, Netlas, DNS brute-force resolution and zcr's built-in discovery engine. CAASM adds asset and coverage data from security tools such as Microsoft Defender, Tenable.io and CrowdStrike. zcr doesn't publish a connector count, and the connectors the demo marks "Coming soon" (AWS Security Hub, Qualys, SentinelOne, Okta) aren't live yet.
How is zcrCTEM different from Cortex Xpanse, Mandiant ASM, and Falcon Surface?
The clearest differences are published, real pricing instead of a mandatory sales conversation, and an open demo you can use without logging in. zcrCTEM also brings EASM, CAASM coverage gaps and DRP takedowns into one console, where anything AI drafts waits for an analyst to approve it.
Does zcrCTEM support MSSPs managing multiple clients?
Yes. Data is scoped per tenant, analysts switch between tenants from the top bar, and each tenant can have its own SSO connection over OIDC or SAML.
Bottom line
None of these four vendors wins on every front. Cortex Xpanse wins on internet-scanning scale and Cortex platform integration. Mandiant ASM wins on breadth of data sources and a proven threat intel pedigree. Falcon Surface wins on prioritization tied to CrowdStrike's own adversary intelligence. All three have real advantages that come from being part of global companies with a decade or more of accumulated investment behind them — advantages a newer market entrant like zcrCTEM hasn't caught up to yet.
What zcrCTEM does offer, verifiably, right now: real published pricing from the start, EASM, CAASM coverage gaps and DRP in one tenant-scoped console, analyst approval on everything AI drafts, a PDPA/CII compliance module, and MSSP-ready tenancy. If your organization's actual needs line up more with those than with global-scale numbers, zcrCTEM is worth checking out before you decide.
If you're still not sure, the fastest way to find out is to try the demo yourself, then talk to a team that will tell you plainly both what the product can actually do and what its limits are before you commit.
Contact the zcr team
Email: hello@cyberdefense.co.th
Phone: 086-940-1383, 082-037-0611
LINE: @cyberdefense
Sources
- Palo Alto Networks 10-Q (Expanse acquisition terms), accessed 2026-09-15.
- Cortex Xpanse product page (scanning scale), accessed 2026-09-15.
- Expanse pack for Cortex XSOAR (integration), accessed 2026-09-15.
- eSecurityPlanet — Attack Surface Management Tools (pricing estimate), accessed 2026-09-15.
- Palo Alto Networks office locations (Bangkok), accessed 2026-09-15.
- Google Cloud press corner — Mandiant acquisition terms, accessed 2026-09-15.
- Mandiant Attack Surface Management product page (250+ sources), accessed 2026-09-15.
- Google Cloud — Attack Surface Management overview PDF (350+ active checks), accessed 2026-09-15.
- Google Cloud blog — Attack Surface Management and Log4Shell response, accessed 2026-09-15.
- Vendr — Mandiant buyer guide (software spend estimate), accessed 2026-09-15.
- Google Cloud — Security Command Center Enterprise tier activation, accessed 2026-09-15.
- Google Cloud press corner — Thailand region launch, accessed 2026-09-15.
- CrowdStrike press release — Reposify acquisition announcement, accessed 2026-09-15.
- CrowdStrike Falcon Surface product page, accessed 2026-09-15.