RiskIQ Digital Footprint and External Threat Management
Attack surface management software
Vulnerability management software
- Features
- Ease of use
- Ease of management
- Quality of support
- Affordability
- Market presence
Take the quiz to check if RiskIQ Digital Footprint and External Threat Management and its alternatives fit your requirements.
Pay-as-you-go
Free Trial unavailableFree version unavailable
Small
Medium
Large
- Information technology and software
- Media and communications
- Banking and insurance
What is RiskIQ Digital Footprint and External Threat Management
RiskIQ Digital Footprint and External Threat Management is a cyber security platform focused on discovering and monitoring an organization’s internet-facing assets and related external threats. It supports security operations and threat intelligence teams by mapping domains, IP space, certificates, cloud services, and third-party exposures, then correlating findings with threat indicators. The product emphasizes continuous external visibility and enrichment from internet telemetry to help prioritize investigation and response workflows.
Broad external asset discovery
The platform is designed to enumerate and track internet-facing assets such as domains, subdomains, IP addresses, certificates, and hosted services. It helps organizations identify unknown or unmanaged assets that commonly fall outside internal CMDB and scanner coverage. This external-first approach aligns well with digital footprint and attack surface management use cases where ownership boundaries are unclear.
Threat intelligence correlation
RiskIQ links discovered assets to external threat signals such as suspicious infrastructure, attacker tooling patterns, and observed malicious activity. This correlation can reduce manual pivoting between asset inventories and threat intelligence sources during investigations. It is particularly useful for SOC and threat intel workflows that need context around why an exposed asset matters.
Continuous monitoring and alerting
The product supports ongoing monitoring of changes in the external footprint, such as new hosts, certificate changes, and newly observed services. This enables near-real-time detection of drift and emerging exposures compared with periodic assessments. Continuous monitoring is valuable for organizations with frequent cloud and web changes where point-in-time scans become stale quickly.
Limited internal vulnerability depth
As an external footprint and threat management tool, it does not replace authenticated internal vulnerability scanning for endpoints, servers, and internal networks. Findings may emphasize exposure and risk signals rather than full CVE coverage and configuration validation inside the environment. Organizations typically still need separate tooling for comprehensive internal vulnerability management and remediation verification.
Tuning required to reduce noise
External discovery and threat correlation can generate alerts that require tuning to match an organization’s asset ownership and risk tolerance. Misattribution (e.g., third-party hosted services, shared infrastructure) can create investigation overhead if not curated. Teams should plan for initial baselining and ongoing rule/asset management to keep signal quality high.
Integration and workflow dependency
Operational value often depends on integrating outputs into ticketing, SIEM/SOAR, and asset management processes. Without clear ownership and remediation workflows, external findings can remain informational rather than actionable. Some organizations may need additional engineering effort to map discovered assets to internal owners and remediation SLAs.
Plan & Pricing
RiskIQ Digital Footprint (Microsoft connector)
| Plan | Price | Key features & notes |
|---|---|---|
| Connector access (Power Automate / Logic Apps) | Pricing not published on product page; licensing required (Premium connector / Logic Apps Standard). Contact Microsoft for pricing. | Available as a Premium connector for Power Automate and as a Logic Apps connector. Provides automated external asset inventory and asset metadata for automated workflows. Official connector page does not list per-seat or per-connector pricing. |
Microsoft Defender External Attack Surface Management (EASM) — Usage-based
Pricing model: Pay-as-you-go (charged on an asset-per-day basis). Free tier/trial: Not published on the product page (see notes). Example costs: Not published on the product page; Microsoft indicates pricing is specific to your environment and shows estimates only — customers should use the Azure pricing calculator or contact a Microsoft sales representative for a quote. Purchase options / notes: Purchase through the Azure portal or via a Microsoft sales representative. Pricing details and precise per-asset/day rates are not published on the product page and require signing in to the Azure pricing calculator or contacting sales.
Seller details
Microsoft Corporation
Redmond, Washington, United States
1975
Public
https://www.microsoft.com/
https://x.com/Microsoft
https://www.linkedin.com/company/microsoft/
