Just saw the demo for their new 'Attack Surface Intelligence' module. Looks promising.

Having just sat through the Recorded Future sales engineering demo for their newly packaged 'Attack Surface Intelligence' (ASI) module, I found myself immediately shifting into a comparative analysis mode against the existing benchmarks in this space. The repackaging of external attack surface management (EASM) capabilities into a distinct module is a clear market response to the growing FinOps and cyber insurance reporting demands. The promise is a unified view of internet-facing assets, enriched with Recorded Future's intelligence context, but the devil, as always, is in the data fidelity and the total cost of ownership.

From a technical standpoint, the demo highlighted several key features that warrant scrutiny:

* **Asset Discovery & Attribution:** Their methodology for discovering assets tied to your organization (beyond simple certificate or WHOIS lookups) appears to leverage a multi-vector approach. The critical question left unanswered is the false-positive/false-negative rate compared to dedicated EASM vendors like Randori (acquired by IBM) or CyCognito. Misattribution can lead to significant wasted remediation effort.
* **Risk Scoring Integration:** They've integrated their proprietary risk scores (`rf-vulnerability-score`, `rf-threat-score`) directly into asset prioritization. This is a double-edged sword.
* *Proprietary Lock-in:* Their risk scoring is opaque. Organizations accustomed to CVSS or other standardized metrics will need to build a translation layer for internal reporting.
* *Contextual Advantage:* If their intelligence on exploit availability and threat actor targeting is as robust as claimed, this could surface risks that pure vulnerability scanners miss.
* **API & Automation:** The demo showed API calls to pull asset lists and risk findings. For enterprise-scale integration into existing ticketing and orchestration platforms, this is non-negotiable. A sample endpoint was shown:
```bash
curl -X GET "https://api.recordedfuture.com/v2/attack-surface/assets?limit=100&status=critical"
-H "X-RF-Token: YOUR_API_KEY"
```
The pagination, filtering granularity (`status=critical`), and rate limits will determine its utility in automated workflows.

The pricing model for this add-on module is the paramount concern. Recorded Future's historical pricing is complex, often based on "intelligence units" or seat counts. Adding ASI as a module could follow two paths:
1. A percentage uplift on the existing core subscription (common with their other modules).
2. A separate, standalone SKU based on number of assets discovered/monitored.

For any team considering this, a rigorous TCO analysis must be conducted against the following:
* The cost of the ASI module itself.
* The potential cost reduction in existing vulnerability scanning/licenses (if ASI can replace or consolidate tools).
* The operational efficiency gain (or loss) from integrating a second risk-scoring paradigm.
* The vendor consolidation benefit versus best-of-breed sourcing.

My initial assessment is that this module will be most compelling for existing Recorded Future enterprise clients who are already bought into their intelligence taxonomy and are seeking to consolidate vendors. For organizations without that existing investment, a head-to-head PoC against pure-play EASM platforms on metrics like asset discovery accuracy, time-to-remediate, and operational overhead is essential. I am particularly interested in community reports on the contractual specifics—does the ASI module come with its own data volume commitments, or is it bundled? Has anyone negotiated a pilot based on asset count?

— Data-driven decisions.