OWASP Amass

At a glance

• Editor score
  7.9 / 10
• Pricing
  Free plan
• Best for
  Technical users wanting free open-source discovery
• Free plan
  Yes
• Paid from
  Free
• Facts checked
  20 Sep 2026

• Where it wins

  • Free open-source external asset discovery and reconnaissance
  • Maps networks and manages findings through an asset database
  • Supports Docker, Docker Compose, and an Engine REST API

• Where it doesn't

  • No verified continuous monitoring capability
  • Does not include cloud discovery or listed integrations
  • Locally operated tool without a commercial support offering

Our verdict on OWASP Amass

OWASP Amass is an open-source framework for information security professionals assessing internet-facing infrastructure. It is aimed at security teams, penetration testers, and technical users who need external asset discovery, attack-surface network mapping, open-source intelligence collection, and active reconnaissance. The tool also includes an asset database for storing and managing findings, plus the Open Asset Model for representing assets and relationships. It runs on Windows, macOS, and Linux, and is distributed as a command-line tool.

Amass stands out for combining discovery and mapping with several deployment options. Users can build it from source, install it with Homebrew, run it through Docker, or deploy it with Docker Compose. The Engine REST API adds a way to connect the tool with other workflows, while the asset database provides a place to retain and manage collected findings. This combination suits technical teams that want control over deployment and asset representation rather than a hosted interface. Its free, open-source model also makes it suitable when avoiding commercial licensing is important.

The trade-off is scope. Amass is a locally operated tool rather than a hosted SaaS product, and it is not presented with verified continuous monitoring, cloud discovery, or listed integrations. It also does not include a commercial support offering. Teams focused on external reconnaissance, network mapping, and programmable asset management should find its feature set aligned with that work. Organizations needing continuous monitoring, cloud-focused discovery, integrated workflows, or commercial support should choose a product built around those requirements instead.

Your product? Our editors can test OWASP Amass in depth and publish a review, labelled as paid · from $149/mo →

OWASP Amass pricing

OWASP Amass fact sheet

Alternatives to OWASP Amass

• CrowdStrike Falcon SurfaceA strong fit for CrowdStrike customers seeking continuous external exposure visibility.9.2
• Tenable One Attack Surface ManagementA strong fit for Tenable users seeking continuous visibility into external assets.9.1
• Qualys External Attack Surface ManagementA broad EASM capability for Qualys customers that need continuous external asset visibility.9.0

See all OWASP Amass alternatives →

Featured on iTechGuides

OWASP Amass is listed in our Attack Surface Management Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/owasp-amass/"><img src="https://www.itechguides.com/best/badge/owasp-amass.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update