Exposure assessment from the scanners you already run
DefectDojo Pro pulls exposures from your vulnerability scanners, cloud tools and attack surface tools into one place, deduplicates them and ranks them with exploit evidence and business context.
What is an exposure assessment platform, and which vendors offer one?
An exposure assessment platform (EAP) continuously identifies and prioritizes exposures, such as vulnerabilities and misconfigurations, across many kinds of assets, using threat intelligence and asset context to decide what to fix first. Gartner's first Magic Quadrant for Exposure Assessment Platforms, published in November 2025, evaluated 20 vendors, including Tenable, Qualys, Rapid7, CrowdStrike, Microsoft, Armis, Brinqa, Nucleus Security and XM Cyber.
DefectDojo Pro takes a different route to the same goal. It doesn't scan or discover assets itself. It imports exposures from the scanners and attack surface tools you already run, including Tenable, Qualys, Wiz, Censys, Shodan, runZero, CyCognito and 500+ others, then deduplicates them and ranks them with EPSS, CISA KEV, reachability and business criticality.
| What an EAP needs to do | How DefectDojo Pro does it |
|---|---|
| Find exposures across internal, external, cloud and code assets | Imports from 500+ scanners plus attack surface connectors for Censys, Shodan, runZero and CyCognito |
| Cover many asset classes | Hosts, web apps, code, dependencies, containers and cloud resources, modeled as Assets and Locations |
| Prioritize by exploitability and context | A Priority score and Risk level that weigh EPSS, CISA KEV, reachability, internet exposure and business criticality |
| Move fixes to owners | Ticket routing to Jira, ServiceNow, Azure DevOps, GitHub and GitLab, with SLAs and breach tracking |
| Report on exposure over time | Dashboards, SLA performance and per-organization reports |
Where EAP fits in CTEM
Gartner's continuous threat exposure management (CTEM) program has five stages: scoping, discovery, prioritization, validation and mobilization. Exposure assessment platforms mainly support discovery and prioritization and feed mobilization, and measuring results across all five shows whether the program is working.
Scoping
Decide which business systems and attack surfaces matter. In DefectDojo this is your Organization and Asset hierarchy, with business criticality set per asset.
Discovery
Find assets and exposures. DefectDojo imports them from your scanners and attack surface tools.
Prioritization
Rank exposures by likely exploitation and impact, using EPSS, KEV, reachability and criticality.
Validation
Confirm exposures are exploitable with pentests and breach simulation. DefectDojo imports those results too.
Mobilization
Get fixes done by routing findings to owners with SLAs, tickets and fix pull requests.
Measurement
Track time to remediate, SLA attainment and backlog trend across every source.
Getting started
Model your assets
Set up Organizations and Assets with owners and business criticality.
Connect your sources
Add scanner imports and connectors for cloud, infrastructure, code and attack surface tools.
Tune prioritization
Adjust the prioritization engine to weigh what matters in your environment.
Route and measure
Send fixes to owners with SLAs and report on exposure over time.
Not a scanner, on purpose
Scanner vendors' platforms work best with their own scanners. DefectDojo sits above every scanner, so you can add, swap or retire tools without losing history or rebuilding workflows.
Read how priority and risk and EPSS and KEV enrichment work.
Pricing and next step
Pay as you go
$100/month plus $0.15 per finding processed. No annual commitment. Sensei AI billed per use.
Pre-pay annually
Pre-pay annually and save 48%+. Sensei AI included.
Community Edition
Community Edition, the open source platform that came out of the OWASP community, stays free.
FAQ
What is an exposure assessment platform?
An exposure assessment platform continuously identifies and prioritizes exposures, such as vulnerabilities and misconfigurations, across many asset types, using threat intelligence and asset context to decide what to fix first. Gartner defines it as a market and published its first Magic Quadrant for it in November 2025.
Which vendors are in Gartner's Exposure Assessment Platforms Magic Quadrant?
The 2025 report evaluated 20 vendors: Armis, Balbix, Brinqa, CrowdStrike, Microsoft, NopSec, Nucleus Security, Outpost24, PlexTrac, Qualys, Rapid7, RedSeal, ServiceNow, Sevco Security, Tanium, Tenable, Trend Micro, Vicarius, WithSecure and XM Cyber.
How does an exposure assessment platform relate to CTEM?
CTEM is a five-stage program: scoping, discovery, prioritization, validation and mobilization. An exposure assessment platform supports discovery and prioritization and feeds mobilization.
Is DefectDojo an exposure assessment platform?
DefectDojo isn't in Gartner's EAP Magic Quadrant. DefectDojo Pro does the prioritization and mobilization work of exposure assessment using findings from your own scanners and attack surface tools, rather than its own scanning.
Does DefectDojo discover assets?
Not by itself. It imports assets and exposures from tools such as runZero, Censys, Shodan and CyCognito, along with 500+ scanners.
How is DefectDojo Pro priced?
Pay As You Go is $100 a month plus $0.15 per finding processed, with no annual commitment. Pre-pay annually and save 48% or more.