What is continuous threat exposure management (CTEM)?
Continuous threat exposure management (CTEM) is a five-stage programme, defined by Gartner, for finding, ranking, testing and fixing the exposures an attacker could use.
What are the five stages of CTEM? Scope, discover, prioritise, validate, mobilise.
Gartner introduced the term in 2022 and describes a loop, not a one-off project. Each pass through the five stages shrinks the list of exposures that matter.
Scoping
Decide which parts of the business the programme covers, such as domains, systems and suppliers, and agree what matters most.
Discovery
Find the assets and exposures inside that scope, including the ones nobody wrote down: internet-facing hosts, open ports, certificates, software with known flaws and leaked staff logins.
Prioritisation
Rank exposures by how likely an attacker is to use them and what the business would lose, not by severity alone.
Validation
Check whether an attacker could really use an exposure, through penetration testing, red teaming or attack simulation.
Mobilisation
Get the fixes made. Give each one an owner and a deadline, and follow it until it is closed.
How is CTEM different from vulnerability management? Wider scope, plus proof.
Vulnerability management is one input to a CTEM programme. CTEM adds scoping, validation and a way to get fixes made.
| Vulnerability management | CTEM | |
|---|---|---|
| What it covers | Known software flaws on the systems you track. | Software flaws plus misconfigurations, exposed services, leaked logins and fake domains. |
| Main question | Which of my systems have a known flaw? | Which exposures could an attacker really use, and what would it cost us? |
| How it ranks | Usually by a severity score. | By likelihood of use, how exposed the asset is and business impact together. |
| Testing | A scanner reports a flaw. It rarely proves an attacker could use it. | A validation stage proves or disproves the attack path. |
| Who acts | Mostly the security or IT team. | Shared with business owners through mobilisation. |
| Rhythm | Scan and patch cycles. | A repeating five-stage loop. |
If you already run vulnerability management, you have the discovery and prioritisation stages for software flaws. The gaps are usually scoping, validation and mobilisation.
What is the difference between ASM and CTEM? One stage versus the whole loop.
Attack surface management (ASM) feeds the discovery stage of CTEM. CTEM is the programme around it.
ASM answers one question: what do we have that anyone online can reach, and what changed? That is discovery. It does not rank what it finds against business impact, test whether an attacker could use it, or manage the fixes.
CTEM answers a larger one: of everything we are exposed to, which exposures could really hurt us, and are they getting fixed? ASM supplies part of the evidence. Prioritisation, validation and mobilisation turn that evidence into reduced risk.
A team can start with ASM and grow into CTEM, one stage at a time. Our guide to attack surface management covers the discovery side in detail.
What is exposure management? The practice inside the programme.
Exposure management is the day-to-day work of finding, ranking and reducing the exposures an attacker could use.
An exposure is anything that gives an attacker a way in or a way further. A known software flaw is one. So are an open database port, a forgotten test server, a leaked staff login and a fake domain that copies your brand.
People use the term in two ways. In a CTEM programme it names the practice that the five stages organise. Vendors also use it for the tools that collect and rank exposures in one place. When a product page says "exposure management", check which stages it actually covers.
Where does EdgeProtect fit? Stage by stage.
EdgeProtect covers discovery and prioritisation, and gives you written plans for mobilisation. It does not do validation.
| CTEM stage | EdgeProtect | What that means |
|---|---|---|
| Scoping | Partly | You choose the domains and the software to add, and domains must be verified as yours. There is no scoping workshop or business-impact modelling. |
| Discovery | Covered | Attack surface scans map subdomains, hosts, ports, services and certificates. Software you track is matched to known flaws. |
| Prioritisation | Covered | Each flaw gets a risk score from 0 to 100. Evidence of real-world exploitation counts most, then severity, then exposure. Your list is ordered by it. |
| Validation | Not provided | EdgeProtect does not test whether an exposure can be used. A scan is discovery, not a penetration test. |
| Mobilisation | Covered, with limits | AI action plans write a prioritised plan from your top-ranked flaws, as a dated snapshot you can export as a PDF. There are no ticketing-system integrations and no task assignment. |
Discovery is scan-based. Scans do not repeat by themselves, so run one whenever something changes and compare it with the last. A scan maps what is visible from the internet. It never attacks anything and is not a penetration test.
For validation, use a human tester. Precursor Security offers penetration testing, which proves whether a path found by discovery can be used. You can read about attack surface scans and risk-based prioritisation on their own pages, or see the plans.
CTEM stands for continuous threat exposure management. Gartner introduced the term in 2022 for a five-stage programme: scoping, discovery, prioritisation, validation and mobilisation.
A programme. CTEM describes a repeating process that people and tools carry out together. No single product covers every stage, so check which stages a tool supports before you buy it as "CTEM".
Attack surface management (ASM) finds and tracks what you have exposed to the internet, which is the discovery stage of CTEM. CTEM adds scoping, prioritisation by business impact, validation by testing, and managing the fixes.
Vulnerability management finds and ranks known software flaws. CTEM covers a wider set of exposures and adds validation, which proves whether an attacker could use them, and mobilisation, which gets fixes made.
No. It covers discovery and prioritisation, and writes action plans for mobilisation. It does not provide validation. For that, use penetration testing, such as the service offered by Precursor Security.
Start with discovery. See what is exposed.
Map the subdomains, hosts, open ports and certificates anyone online can reach, rank your known flaws by risk, and get a written plan for what to fix first.