Field notes · Definition · Survey date: September 2026
What Is CAASM?
2 min read
Bottom line
CAASM stands for cyber asset attack surface management. CAASM tools connect to the security and IT systems an organization already runs, consolidate their asset data into one view and show coverage gaps, such as devices missing an agent or accounts with no owner.
How does a CAASM tool work?
Through integrations rather than its own agents. A CAASM tool pulls asset records from endpoint management, EDR, identity providers, cloud accounts, vulnerability scanners and the CMDB, matches records that describe the same asset, and flags conflicts. The quality of a CAASM tool depends on how many sources it reads and how well it correlates them, which is why this site weights those two criteria at 40% together.
Which tools are CAASM tools?
Several vendors in our ranking use the term. runZero describes itself as a CAASM solution and adds its own active and passive discovery. JupiterOne lists CAASM among its use cases. Axonius grew from CAASM into a broader asset intelligence platform with exposure prioritization and automated actions.
How is CAASM different from a CMDB?
A CMDB is a system of record for IT service processes. A CAASM tool reads the CMDB as one of many sources and checks it against the others. See CMDB vs asset inventory.
Related terms
Tools that do this
Frequently asked questions
What does CAASM stand for?
Cyber asset attack surface management.
Does a CAASM tool scan my network?
Many do not; they rely on integrations with tools that already see the assets. Some, such as runZero, combine integrations with their own discovery.