Beareye · Exposure
CTEM (Continuous Threat Exposure Management): managing exposure continuously
By Steven Carrier Updated on
CTEM (Continuous Threat Exposure Management) is a framework put forward by Gartner in 2022 to continuously discover, prioritise, validate and reduce an organisation’s exposure, rather than at the pace of an annual audit. It replaces the vulnerability list with an attacker’s question: which attack paths actually lead to the assets that matter? Beareye runs this programme on a single platform, from discovery to proof.
- Continuous programme
- Offensive validation
- Developed in France
Why is vulnerability management no longer enough?
Handling vulnerabilities one by one is like emptying the sea with a teaspoon: the list keeps growing and nothing tells you what an attacker would actually exploit. Vulnerability management remains necessary, but it ignores the uninventoried scope and the way weaknesses chain together into an attack path .
The vulnerability list
The attack paths that can actually be exploited
What are the five stages of a CTEM programme?
A CTEM programme runs in cycles of five stages. The first two diagnose exposure, the next three reduce it, and the outcome of the last one feeds the scoping of the next cycle.
-
Scope
Decide, with senior management, which areas would have the greatest business impact if compromised.
-
Discover
Inventory the assets in that scope and their exposures: vulnerabilities, misconfigurations, leaked credentials, forgotten services.
-
Prioritise
Rank by exploitability, business criticality and position in an attack path, rather than by an isolated score.
-
Validate
Confirm real exploitability through attack simulation , with your defences in place.
-
Mobilise
Assign each fix to an owner with a deadline, then replay the attack to check that it holds.
CTEM framework put forward by Gartner in 2022, presented in the article How to manage cybersecurity threats, not episodes (2023).
How does Beareye implement CTEM?
| CTEM stage | Beareye component |
|---|---|
| Discover the external surface | EASM module |
| Inventory internal and cloud assets | CAASM module |
| Prioritise vulnerabilities | Vulnerability management |
| Validate exploitability | Automated Red Team (BAS/ CART ) |
| Mobilise and measure | Command Center |
Why prioritise by attack path?
CTEM does not rank weaknesses by isolated severity but by their role in an attack path. A medium vulnerability that opens access to a critical asset comes before a severe vulnerability that leads nowhere. Beareye reconstructs these paths and focuses the effort on those that lead to what matters most.
Which indicators prove that exposure is falling?
A CTEM programme is steered by indicators: the number of critical attack paths opened then closed, time to remediate, scope coverage, and how exposure changes over time. Beareye produces these indicators and presents them in reports that senior management can read.
Vulnerability management remains the remediation stage of CTEM, which adds scoping, offensive validation and continuous measurement of risk reduction. To find out which approach suits your organisation, compare CTEM and vulnerability management . To go further: Implementing CTEM: what Gartner’s framework leaves out (article in French).
How many critical attack paths does a first CTEM cycle bring to light?
A first CTEM cycle run with Beareye brings to light a median of 24 critical attack paths per organisation. 70% of them are closed within five days of being identified, and the effectiveness of each fix is verified. This first cycle is the baseline: later cycles measure how much exposure has fallen against it.
Aggregated, anonymised data from Beareye CTEM programmes: 20 organisations over two years. Median number of distinct critical paths in the first cycle; share of paths closed and verified within five days of identification.
Sources and references
Sources consulted on . Report an error: contact+site@bearops.fr
Frequently asked questions
What is CTEM?
CTEM (Continuous Threat Exposure Management) is an approach put forward by Gartner in 2022 that consists of continuously managing an organisation’s exposure to threats, in five stages: scope, discover, prioritise, validate and mobilise. It aims to reduce the risk that can actually be exploited, not just to list vulnerabilities.
Is CTEM a product or a method?
CTEM is a methodological framework defined by Gartner, not a product. Beareye is the platform that puts it into practice, bringing discovery, prioritisation, validation and remediation together in one place.
What role does validation play in a CTEM programme?
Validation confirms that an exposure can actually be exploited before remediation teams are mobilised. It relies on attack simulation, which replays an attacker’s techniques against the defined scope. It is also used after remediation: replaying the same scenario checks that the fix holds and feeds the risk-reduction indicators.
How long does it take to launch a CTEM programme?
Scoping takes 5 days with your teams. The first full cycle, from discovery to validation of the priority attack paths, is completed in 6 weeks. The programme then runs continuously: each subsequent cycle measures the reduction in exposure compared with the previous one.
Where do you stand in your CTEM journey
A scoping call assesses your CTEM maturity and identifies the first exposures to address as a priority, on your own scope.