In short: TrendAI Vision One Cyber Risk Exposure Management (CREM), formerly Attack Surface Risk Management, discovers devices, identities, internet-facing and cloud assets, scores their risk and prioritises fixes. Core covers discovery, vulnerability and identity posture; Essentials adds attack path prediction, security awareness and compliance. Cloud accounts are licensed in bands of resources.
What CREM is
Cyber Risk Exposure Management (CREM) is the risk layer of TrendAI Vision One. It replaced Attack Surface Risk Management (ASRM) and answers three questions: what do we have, where are we exposed, and what should we fix first?
CREM draws on Trend Micro's own agents and sensors, connected third-party tools and its own scanning to build an inventory of devices, identities, cloud assets and internet-facing services, including ones IT did not know about. It then scores risk using context such as vulnerabilities, misconfigurations, threat activity and how critical the asset is to the business, so the team works on the exposures most likely to be used against you. Trend Micro positions it as a way to consolidate external attack surface management, vulnerability management, cloud security posture management, identity security posture and security awareness.
Core and Essentials packages
Device assessment comes in two packages, with Essentials the fuller one:
| Capability | Core | Essentials |
|---|---|---|
| Cyber Risk Overview dashboard | Yes | Yes |
| Attack Surface Discovery | Yes | Yes |
| Threat and Exposure Management | Yes | Yes |
| Identity Security Posture | Yes | Yes |
| Vulnerability management with Network Vulnerability Scanner | Yes | Yes |
| Attack Path Prediction | No | Yes |
| Security Awareness (phishing simulation and training) | No | Yes |
| Compliance Management | No | Yes |
Trend Micro makes the Cyber Risk Overview available to all Vision One users at no charge, so you can see a headline risk picture before choosing a package.
Cloud account assessment
Cloud accounts are assessed separately from devices. Trend Micro lists this as Cloud Risk Management, part of both CREM and Cloud Security, and it covers cloud security posture (misconfiguration and compliance checks), internet-facing asset assessment, attack path identification, data security posture, AI security posture, cloud identity entitlements, infrastructure-as-code template scanning and agentless vulnerability and malware scanning.
It is licensed per connected cloud account, in bands of 500 cloud resources, up to a top band for accounts with more than 3,500 resources. It can be used without XDR.
How CREM is licensed
CREM is part of TrendAI Flex. Device assessment counts assessed desktops and servers, including unmanaged ones that carry risk, plus network infrastructure devices found by the Network Vulnerability Scanner; mobile devices and anything on your exception list are not counted. Usage is taken from daily snapshots, with the highest days excluded as outliers.
Through Forever Systems, Trend Micro is billed monthly in arrears for what you actually used in the month, measured the way Trend Micro measures it, rather than as a credit pool you pay for up front. You can change package or exclude assets in the console. Ask us for a quote.
Who it suits and how we help
CREM suits organisations that have more vulnerabilities than time, need to show risk to a board or insurer, or are preparing for Cyber Essentials and want a running view of patching and configuration. It complements, rather than replaces, periodic penetration testing. Small businesses on Worry-Free can update their console to Vision One and add CREM on top of their existing protection.
Forever Systems connects your data sources and cloud accounts, sets which assets are business critical, tunes the risk scoring and runs regular reviews so the top risks actually get fixed. See vulnerability management and penetration testing for other options.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is CREM the same as Attack Surface Risk Management?
Yes. Trend Micro renamed Attack Surface Risk Management (ASRM) as Cyber Risk Exposure Management (CREM) and has since added capabilities such as identity posture, compliance management and security awareness.
What is the difference between CREM Core and Essentials?
Both include attack surface discovery, threat and exposure management, identity security posture and network vulnerability scanning. Essentials adds attack path prediction, security awareness training and compliance management.
How is CREM cloud account assessment licensed?
Per connected cloud account, in bands of 500 cloud resources, with a top band for accounts above 3,500 resources.
Does CREM replace a penetration test?
No. CREM gives continuous visibility of exposures and prioritises fixes, while a penetration test has a person actively try to break in. Many organisations use both.