The product
Amass is an open-source OWASP tool for comprehensive attack surface mapping and asset discovery through domain reconnaissance and subdomain enumeration.
The closest Amass alternatives are ctlogs.dev, MGM Security Partners recon me and SurfaceDiff. Picking an Amass alternative comes down to fit: External Attack Surface Management coverage, your environment, your integrations and your budget. So each option below shows what it covers, how it deploys, its pricing model and the company behind it.
45 alternativesClosest matches: ctlogs.dev, MGM Security Partners recon me, SurfaceDiffPage updated Nov 2026
The product
Amass is an open-source OWASP tool for comprehensive attack surface mapping and asset discovery through domain reconnaissance and subdomain enumeration.
Amass is a free External Attack Surface Management solution. The closest matches by shared tags and NIST CSF 2.0 coverage are ctlogs.dev, MGM Security Partners recon me, SurfaceDiff, DDactic Attack Surface Discovery, and Detectify Platform. All 45 alternatives on this page are ranked the same way.
These 8 solutions overlap most with Amass. Each row says what the product does and, when the overlap is big enough, which capabilities it shares.
Fast Certificate Transparency search and JSON API for subdomain reconnaissance.
Key features: Real-time Certificate Transparency Search, Automated Subdomain Enumeration, High-Performance REST JSON API, Wildcard & Fingerprint Matching, SSL/TLS Certificate History Tracking
Shares 3 capabilities with Amass: Reconnaissance, DNS Security, Subdomain Enumeration
recon me is an OSINT tool developed by mgm Security Partners and used as part of the company's OSINT analysis service. The tool collects and correlates publicly available information about an organization's external attack surface, including domains, subdomains, servers, technologies used, metadata, and publicly accessible files. It supports two scan modes: - Passive scan: queries public directory services such as Whois, DNS, and MX records to identify servers, subdomains, email addresses, technologies, and operators (e.g. Amazon, Akamai) without any interaction with target systems. - Active scan: directly examines the target domain without performing attacks, to identify additional services, technologies, or unintentionally exposed files. Results from recon me are combined with manual expert analysis and used to produce a report detailing identified assets, potential vulnerabilities, misconfigurations, and prioritized recommendations. The output is intended to give organizations a view of their public attack surface from an attacker's perspective and can serve as a basis for further security testing such as penetration tests.</description> <parameter name="summary">Proprietary OSINT tool for mapping an organization's public attack surface
Key features: 8 listed. See them on the MGM Security Partners recon me page.
Shares 4 capabilities with Amass: Reconnaissance, Network Reconnaissance, DNS Security, Subdomain Enumeration
View MGM Security Partners recon meMGM Security Partners recon me alternativesAmass vs MGM Security Partners recon me
Continuous external attack surface monitoring that shows what changed between scans.
Key features: 9 listed. See them on the SurfaceDiff page.
Shares 3 capabilities with Amass: Reconnaissance, DNS Security, Subdomain Enumeration
View SurfaceDiffSurfaceDiff alternativesAmass vs SurfaceDiff
Scans domains to discover attack surface, vulnerabilities, and generate hardening
Key features: 10 listed. See them on the DDactic Attack Surface Discovery page.
Shares 3 capabilities with Amass: Reconnaissance, DNS Security, Subdomain Enumeration
View DDactic Attack Surface DiscoveryDDactic Attack Surface Discovery alternativesAmass vs DDactic Attack Surface Discovery
Platform for external attack surface management and application security testing
Key features: 10 listed. See them on the Detectify Platform page.
View Detectify PlatformDetectify Platform alternativesAmass vs Detectify Platform
Maps external attack surface including assets, dark web exposure, and leaks.
Key features: 10 listed. See them on the Muscope|Risk - Attack Perimeter page.
View Muscope|Risk - Attack PerimeterMuscope|Risk - Attack Perimeter alternativesAmass vs Muscope|Risk - Attack Perimeter
AI-powered EASM platform for digital asset discovery and monitoring.
Key features: 5 listed. See them on the Cylana EASM page.
View Cylana EASMCylana EASM alternativesAmass vs Cylana EASM
AI-enhanced EASM platform for external attack surface discovery and monitoring.
Key features: 10 listed. See them on the TRaViS page.
Fast Certificate Transparency search and JSON API for subdomain reconnaissance.
Continuous external attack surface monitoring that shows what changed between scans.
Scans domains to discover attack surface, vulnerabilities, and generate hardening
Platform for external attack surface management and application security testing
Maps external attack surface including assets, dark web exposure, and leaks.
AI-powered EASM platform for digital asset discovery and monitoring.
AI-enhanced EASM platform for external attack surface discovery and monitoring.
Agentless external attack surface monitoring with continuous change detection.
ASM platform monitoring external attack surface, dark web leaks & 3rd-party risks.
Internet intelligence platform for asset discovery and attack surface mapping
SOCRadar Attack Surface Management is an EASM platform that continuously discovers, monitors, and assesses internet-facing digital assets for vulnerabilities and security risks.
Automated ASM tool for multi-cloud environments with continuous asset discovery
Active attack surface mgmt solution for discovering & remediating unknown risks
DNS security posture management across multicloud and on-prem environments
Discovers and inventories internet-facing assets including subdomains, IPs, and apps.
Customizable ASM platform for asset discovery, monitoring, and enrichment
Attack surface management platform for discovering and securing exposed assets
EASM platform that discovers, attributes, and actively validates external assets and risks
ASM platform that scans external attack surfaces hourly for vulnerabilities
Automated digital asset discovery and monitoring for external attack surface
External attack surface management platform for asset discovery and monitoring
External attack surface mapping service to discover exposed digital assets
OSINT tool for mapping & monitoring risk ecosystems on Clear & Deep Web.
Continuous external asset discovery and monitoring with daily domain scans.
ASM platform for continuous discovery and risk validation of internet-exposed assets.
Agentless EASM platform for asset discovery, exposure mgmt & risk reduction.
Sn1per Professional 2026: automated penetration testing & attack surface management
DNS posture mgmt platform for real-time DNS & WHOIS change monitoring.
Agentless external attack surface & dark web monitoring platform.
Continuous, agentless discovery and threat-intel enrichment of external internet-facing
Internet-wide scanning platform for discovering exposed devices, services
External attack surface monitoring with dark web intelligence and scanning
External attack surface scanning for MSPs to identify vulnerabilities
Passive pre-sale domain diagnostic tool for vCISOs, MSPs & MSSPs.
External attack surface management built on the DNS you already control.
Cloud platform for continuous visibility & mgmt of external attack surfaces
AI-powered attack surface management platform for cybersecurity monitoring
AI-powered platform for continuous attack surface discovery and pentesting
Discovers and monitors external-facing assets and vulnerabilities
External attack surface management platform with continuous asset discovery
External attack surface management platform for discovering digital assets
SaaS platform for attack surface management and vulnerability detection
Common questions when weighing alternatives to Amass.
The closest matches to Amass by shared tags and NIST CSF 2.0 coverage are ctlogs.dev, MGM Security Partners recon me, SurfaceDiff, DDactic Attack Surface Discovery, and Detectify Platform. All of them are External Attack Surface Management products.
This page shows 45 alternatives to Amass, all in the External Attack Surface Management category. Each one is matched on shared tags and NIST CSF 2.0 areas, and the closest matches rank first.
Amass is a free External Attack Surface Management product. You can use it at no cost. Only commercial alternatives are listed here. Free and open source products are under /free.
Amass is a External Attack Surface Management product in the Exposure & Vulnerability Management category. You can compare it with the 45 other External Attack Surface Management products on this page.
Need the answer fast? Best Attack Surface Management Solutions for Business picks Palo Alto Networks Cortex Xpanse, Microsoft Defender EASM, Mandiant Attack Surface Management and 4 more.See the shortlist
