Attack Surface Management Resource

The New York State Department of Financial Services is seeking proposals for an Attack Surface Management (ASM) tool to monitor cybersecurity vulnerabilities across department-regulated entities and critical third-party service providers. This procurement, conducted under New York State Finance Law Article XI, aims to acquire a comprehensive monitoring resource that can identify unpatched system vulnerabilities and potential cybersecurity threats for specific entities and industry segments. The ASM tool will enable data-driven actions, including targeted notifications to high-risk entities and providing specialized cybersecurity guidance. Interested vendors must submit proposals by 3:00 PM ET on September 9, 2025, with preliminary questions due by 3:00 PM ET on August 19, 2025. Answers to vendor questions will be posted on the department's website around August 25, 2025. The contract will have a five-year term and will cover all New York State counties, with the procurement document and related attachments available for download from the Department of Financial Services' procurement website.

The contract opportunity does not include any set-aside designations for service-disabled veteran-owned, minority-owned, women-owned, or disadvantaged businesses, with all associated sub-contracting goals set at 0%. Previous vendors who have provided similar services include Security Scorecard and ThunderCat Technology, with the latter having supplied Google Threat Intelligence Enterprise solutions. The procurement indicates that these goods or services have been previously purchased from out-of-state or foreign vendors within the past three years. While specific budget ranges were not explicitly detailed in the contract opportunity description, the comprehensive nature of the ASM tool and its five-year contract term suggest a significant investment in cybersecurity monitoring and threat detection capabilities. Prospective vendors should carefully review the Request for Proposals (RFP) and associated attachments to fully understand the technical requirements and evaluation criteria for this strategic cybersecurity procurement.