External attack surface management (EASM) buyer's guide