HailBytes ASM vs Palo Alto Cortex Xpanse
A self-hosted EASM alternative for teams that want continuous external recon without a Cortex XSIAM commitment, or that need scan ownership and white-label deliverables.
TL;DR
Cortex Xpanse (the rebranded Expanse acquisition) is enterprise EASM tightly integrated with Cortex XSIAM and the broader Palo Alto Networks platform. List prices are firmly enterprise-tier. HailBytes ASM is a self-hosted alternative that runs the recon pipeline inside your own AWS or Azure account, priced on infrastructure rather than as a Cortex module.
- Pick HailBytes ASM if you don’t want a Cortex platform commitment, need white-label deliverables, want unlimited scans at a flat VM cost, or need full data residency.
- Stay with Cortex Xpanse if you’re already a heavy Palo Alto / XSIAM customer and want EASM data correlated with XDR telemetry inside the same platform.
Pricing & Cost Model
| Dimension | HailBytes ASM | Cortex Xpanse |
|---|---|---|
| Pricing axis | Infrastructure ($0.24/vCPU/hour) | Per IP / per asset (enterprise tier) |
| Annual cost (small surface) | $5,880 (4 vCPU, ASM’s documented minimum; $8,400 list), all-in $8,520 committed and $11,040 at list | $50,000+ entry |
| Annual cost (mid surface) | $11,760–$23,520 (8–16 vCPU; $16,800–$33,600 list) | $100,000–$250,000 |
| Annual cost (Fortune 500 surface) | $23,520–$47,110 (16–32 vCPU; $33,600–$67,300 list) | $500,000+ |
| Free trial | 30 days via AWS / Azure Marketplace | Sales-led demo / pilot |
| Procurement path | Cloud marketplace (counts toward EDP / MACC) | Direct PAN contract |
HailBytes figures are the 1-year commitment price (delivered as an AWS or Azure private offer, not a discount on the published meter) with list alongside, so the comparison sits on the same annual-contract basis as the competitor column. The meter covers software only; the VM, storage, and networking run in your own cloud account and are billed separately at roughly $35/vCPU/month, $220/month at 4 vCPU, $280 at 8, $560 at 16, and $1,120 at 32, so scale that line to the size on the row you are reading.
Our cost steps with the size of the surface rather than scaling per asset, so every comparison on this page is calculated all-in against the rung that fits. 4 vCPU is ASM’s documented minimum and suits a small, stable surface (about $8,520/year all-in on a 1-year commitment, $11,040 at list). 8 vCPU is the size ASM’s own hardening guide names Production (recommended) and covers 10 to 50 scheduled scans a day ($15,120 / $20,160). 16 vCPU covers 50+ scans a day ($30,240 / $40,320). Quote 4 vCPU only where the surface genuinely is small and stable; 8 vCPU is the size we recommend for production. Full pricing.
Sizing above 8 vCPU: ASM sizes its scan worker from the host, so a larger instance scans proportionally faster: a 16 vCPU deployment gives the scan engine twice the cores an 8 vCPU one does. Instances deployed before August 2026 pick this up on the next update, when the installer rewrites the worker limits to match the machine.
Architecture & Control
| Dimension | HailBytes ASM | Cortex Xpanse |
|---|---|---|
| Deployment | Self-hosted in your AWS / Azure account | SaaS (PAN-hosted) |
| Source code access | Ships with the deployment; auditable under NDA | Closed source |
| Data residency | Whatever cloud region you pick | PAN-controlled regions |
| Custom scan logic / wordlists | ✅ Full control | ❌ |
| Per-tenant isolation | One VM per tenant | Multi-tenant SaaS |
Capability Comparison
| Capability | HailBytes ASM | Cortex Xpanse |
|---|---|---|
| Subdomain enumeration | ✅ Multi-source | ✅ |
| Internet-wide scan dataset | 🟡 Active scans only | ✅ Global scan dataset |
| Active port & service scanning | ✅ | ✅ |
| CVE matching | ✅ | ✅ |
| XDR / SIEM correlation | 🟡 Bring your own SIEM | ✅ Native XSIAM (key differentiator) |
| Active Attack Surface Reduction (ASR) | 🟡 Findings + Jira/Slack routing | ✅ Auto-remediation playbooks |
| Unlimited scans | ✅ | 🟡 Tier-based |
| Custom wordlists | ✅ Unlimited | ❌ |
| AI-powered analysis | ✅ OpenAI + Ollama (local GPU) | ✅ Cortex AI |
| MCP server / AI-agent tooling | ✅ Built-in (Claude / Cursor / Windsurf) | ❌ |
| Government cloud (GovCloud / Azure Gov) | ✅ Both | 🟡 Limited |
| White-label for client deliverables | ✅ Built-in | ❌ |
See It in the Product
Xpanse is bought as part of the Cortex platform. These two screens are the standalone equivalent, running in your own tenancy.
Captured from a running instance. See all 48 screens →
When HailBytes ASM Wins
- You don’t want a Cortex/XSIAM commitment. Xpanse’s value compounds inside the PAN platform; standalone is hard to justify against a self-hosted alternative.
- MSSPs and pen-test firms. A flat per-instance cost and white-label output are what make resold continuous monitoring profitable to package.
- Government and regulated industries. AWS GovCloud and Azure Government deployments keep scan data inside the tenancy you already control.
- AI-agent recon workflows. A built-in MCP server lets Claude, Cursor, and Windsurf drive scans and finding triage from the IDE.
When Cortex Xpanse Wins
- Heavy PAN / XSIAM customers. Native correlation and the ASR auto-remediation playbooks are real differentiators.
- Fortune-500 scale orgs with the procurement appetite for PAN’s pricing tier.
- Existing PAN contract spend that absorbs the Xpanse SKU at marginal cost.
Try HailBytes ASM
The marketplace listings on AWS and Azure each include a 30-day trial that covers the underlying VM.
Related Comparisons
Other enterprise and platform-vendor EASM products usually evaluated alongside Cortex Xpanse:
- vs Microsoft Defender EASM: Azure-native external ASM.
- vs CrowdStrike Falcon Surface: Falcon-bundled EASM.
- vs Detectify: SaaS web-app surface monitoring.
- vs runZero: asset inventory and network discovery.
- Full ASM comparison matrix: every vendor side by side, plus the HailBytes ASM product page.
See HailBytes ASM in Action
Skip the slide deck. Watch the product run end-to-end before you book a call.
Try HailBytes ASM Free
Get a free trial deployment on AWS or Azure. Our team walks you through setup and your first steps, whether that’s a single organization or a multi-client rollout.
- ✓ 30-day free trial on AWS or Azure
- ✓ Guided onboarding from our security team
- ✓ No credit card required to start
- ✓ 40+ security tools pre-configured