SIDE BY SIDE · FACTS ONLY

Defender EASM vs runZero: asset inventory facts side by side

SHORT ANSWER

Defender EASM describes 2 of the five approaches on the pages we read and runZero describes 3; they differ on CAASM aggregation, Agent-based inventory, External attack surface management, CMDB-centred inventory and Exposure management. On collection, Defender EASM works without new agents and runZero works without new agents. Many estates run two of these approaches together, so the question is often which pair, not which one; we do not score either.

By The Inventory Desk · CAASM Finder · Published 2026-10-11

Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.

How do their approaches compare?

Top bar: Microsoft Defender EASM
Lower bar, lighter: runZero

Full bar: described on the vendor's pages we read
Hatched bar: described with a condition (another product, a higher tier, or part of the approach)
Stub: not in our sources (it may exist; we did not find it)

The bars show what each vendor's own pages describe, or how your answers weigh the five approaches. They are not a measure of how well a product works.

What are the facts, side by side?

From each vendor's own pages. Differs marks rows where the recorded status or check value differs.
Fact	Microsoft Defender EASM	runZero
Positioning	Microsoft's external attack surface management service, run as an Azure resource, with a prebuilt inventory, recursive discovery from seeds and billing on the Azure bill.	An asset discovery platform that runZero describes as CAASM: active scanning, passive discovery for fragile OT networks and integrations, with each asset profiled against nearly 1,000 attributes.
Deployment	An Azure resource. Cross-tenant resource access, including Azure Lighthouse, is not supported. Source: Microsoft Learn: Defender EASM overview · Read 27 Sep 2026	SaaS or on-premises, including air-gapped environments; no agents, authentication or appliances required. Source: runZero platform · Read 27 Sep 2026
CAASM aggregationDiffers	Not in our sources Not described on the pages we read.	Described Describes itself as CAASM: integrations with ServiceNow, CrowdStrike, Intune, AWS, Azure, Google Cloud, Entra ID, Tenable, Rapid7, Qualys and others combine with its own scan data. Source: runZero integrations · Read 27 Sep 2026
Agent-based inventoryDiffers	Not in our sources Not described on the pages we read.	With a condition Collects its own data by active scanning and passive discovery, without agents. Source: runZero platform · Read 27 Sep 2026
External attack surface managementDiffers	Described A prebuilt inventory for many organisations plus recursive discovery from seeds you supply. Source: Microsoft Learn: what is discovery · Read 27 Sep 2026	Not in our sources Not described on the pages we read.
CMDB-centred inventoryDiffers	Not in our sources Not described on the pages we read.	With a condition Enriches a ServiceNow CMDB rather than acting as one. Source: runZero integrations · Read 27 Sep 2026
Exposure managementDiffers	With a condition Dashboards for vulnerabilities, compliance and hygiene on external assets; remediation happens downstream through Log Analytics and Azure Data Explorer. Source: Microsoft Learn: data connections · Read 27 Sep 2026	Not in our sources Not described on the pages we read.
Servers and network devicesDiffers	Not in our sources	Matches Active scanning of IT, OT, IoT, cloud, mobile and remote assets. Source: runZero platform · Read 27 Sep 2026
Cloud workloadsDiffers	Not in our sources	Matches Cloud assets, with AWS, Azure and Google Cloud integrations. Source: runZero integrations · Read 27 Sep 2026
SaaS applications	Not in our sources	Not in our sources
Identities as assetsDiffers	Not in our sources	Partly Entra ID is a listed integration; identities are not described as an asset class. Source: runZero integrations · Read 27 Sep 2026
Off-network laptopsDiffers	Not in our sources	Matches Remote assets are a listed class. Source: runZero platform · Read 27 Sep 2026
OT and IoT devicesDiffers	Not in our sources	Matches Passive discovery for OT. Source: runZero platform · Read 27 Sep 2026
Internet-facing discoveryDiffers	Matches Prebuilt inventory and recursive discovery from seeds. Source: Microsoft Learn: what is discovery · Read 27 Sep 2026	Not in our sources
Offers its own agentDiffers	Not in our sources	Not in our sources
Works without new agents	Matches An Azure service that discovers from seeds and a prebuilt inventory. Source: Microsoft Learn: Defender EASM overview · Read 27 Sep 2026	Matches No agents, authentication or appliances. Source: runZero platform · Read 27 Sep 2026
Merges records from several sourcesDiffers	Not in our sources	Matches Profiles each asset against nearly 1,000 attributes. Source: runZero homepage · Read 27 Sep 2026
Feeds or updates a CMDBDiffers	Not in our sources	Matches ServiceNow integration for CMDB enrichment. Source: runZero integrations · Read 27 Sep 2026
Cross-source queries and reports	Partly Dashboards for vulnerabilities, compliance and hygiene. Source: Microsoft Learn: Defender EASM overview · Read 27 Sep 2026	Partly AI-assisted reporting on the Platform plan. Source: runZero pricing · Read 27 Sep 2026
Workflows, tickets or actionsDiffers	Partly Data connections to Log Analytics and Azure Data Explorer trigger remediation actions downstream. Source: Microsoft Learn: data connections · Read 27 Sep 2026	Not in our sources
Price or pricing basis publishedDiffers	Partly Billable assets are defined (approved host:IP combinations, domains and IP addresses) and charged on the Azure bill; Microsoft's pricing page showed no rate when we read it. Source: Microsoft Learn: understanding billable assets · Read 27 Sep 2026	Matches Community Edition free for 100 or fewer assets; runZero Platform starts at $5,000. Source: runZero pricing · Read 27 Sep 2026
Free tier or trial	Matches A 30-day free trial, then Azure billing. Source: Microsoft Learn: understanding billable assets · Read 27 Sep 2026	Matches Free, full-featured 21-day trial. Source: runZero pricing · Read 27 Sep 2026
Platform it is part of	Microsoft: Native to Azure, billed on the Azure bill, with a Security Copilot integration in preview. Source: Microsoft Learn: Defender EASM documentation · Read 27 Sep 2026	None
Integrations	Data connections to Log Analytics and Azure Data Explorer, and a Security Copilot integration in preview. Source: Microsoft Learn: data connections · Read 27 Sep 2026	ServiceNow, CrowdStrike, Intune, AWS, Azure, Google Cloud, Entra ID, Tenable, Rapid7, Qualys, VMware, Wiz, SentinelOne, Tanium and Splunk, plus a custom integration SDK. Source: runZero integrations · Read 27 Sep 2026
Price	Billed through Azure on billable assets (approved host:IP combinations, domains and IP addresses) after a 30-day free trial. Microsoft's pricing page did not show a rate when we read it; check it for the current figure. Source: Microsoft Learn: understanding billable assets · Read 27 Sep 2026	Published: Community Edition free for 100 or fewer assets with 30-day retention; runZero Platform starts at $5,000 with 3-year retention; free 21-day trial. Source: runZero pricing · Read 27 Sep 2026

Where do they differ?

CAASM aggregation: Defender EASM is not in our sources; runZero describes it.
Agent-based inventory: Defender EASM is not in our sources; runZero describes it with a condition.
External attack surface management: Defender EASM describes it; runZero is not in our sources.
CMDB-centred inventory: Defender EASM is not in our sources; runZero describes it with a condition.
Exposure management: Defender EASM describes it with a condition; runZero is not in our sources.
Servers and network devices: Defender EASM is not in our sources; runZero matches.
Cloud workloads: Defender EASM is not in our sources; runZero matches.
Identities as assets: Defender EASM is not in our sources; runZero partly matches.
Off-network laptops: Defender EASM is not in our sources; runZero matches.
OT and IoT devices: Defender EASM is not in our sources; runZero matches.
Internet-facing discovery: Defender EASM matches; runZero is not in our sources.
Merges records from several sources: Defender EASM is not in our sources; runZero matches.
Feeds or updates a CMDB: Defender EASM is not in our sources; runZero matches.
Workflows, tickets or actions: Defender EASM partly matches; runZero is not in our sources.
Price or pricing basis published: Defender EASM partly matches; runZero matches.

Can they work together?

Yes, on the pages we read:

Intune, Azure and Entra ID are listed integrations.
Source: runZero integrations · Read 27 Sep 2026

Choose Defender EASM if

You are on Azure and want an external inventory without a sales call
You want an outside-in baseline before choosing an inventory platform

Choose runZero if

You need to find unmanaged devices on the network, including OT, without agents
You want a published price and a free tier to start

Which limits should you check?

Defender EASM

External assets only: internal devices, SaaS apps and identities are not covered.
No built-in remediation workflow, and no cross-tenant resource access for groups with several Azure tenants.

runZero

SaaS applications are not covered on the pages we read.
No workflow or enforcement actions of its own are described; action happens in ServiceNow or other tools.
Ownership changed in September 2026 (Dragos acquisition); roadmap effects are not yet published.

Put Defender EASM and runZero in the asset census with others Run the finder

Questions people ask

Is Defender EASM or runZero better?

Neither is scored on this site. Defender EASM describes 2 of five approaches and runZero 3 on the pages we read, and they differ on 15 recorded facts. Which fits depends on where your assets live, whether you can install agents, your CMDB and your tools; the finder checks those.

Do Defender EASM and runZero work with a CMDB?

Defender EASM: Not in our sources. runZero: Matches. ServiceNow integration for CMDB enrichment.

Do Defender EASM or runZero publish prices?

Defender EASM: Billed through Azure on billable assets (approved host:IP combinations, domains and IP addresses) after a 30-day free trial. Microsoft's pricing page did not show a rate when we read it; check it for the current figure. runZero: Published: Community Edition free for 100 or fewer assets with 30-day retention; runZero Platform starts at $5,000 with 3-year retention; free 21-day trial.