From vulnerability management to exposure management: CTEM, CSPM and metrics
In short: Exposure management widens vulnerability management to cover everything an attacker could use, including unknown internet-facing assets, cloud misconfigurations and identity weaknesses. Continuous threat exposure management (CTEM) runs this as a five-stage cycle: scoping, discovery, prioritisation, validation and mobilisation.
Why vulnerability management is widening
Classic vulnerability management scans a list of known servers for missing patches and ranks the results by score. That still matters, but modern attacks often use things that list misses: a forgotten cloud test system, an over-permissive storage bucket, an admin account without MFA, or a supplier's connection. Exposure management tries to see all of these together and asks which combinations would actually let an attacker reach something important. It builds on risk-based prioritisation rather than replacing it.
The CTEM cycle
Continuous threat exposure management (CTEM) is a programme model described by the analyst firm Gartner. It has five stages:
- Scoping: choose a business area, such as online payments, and agree what matters there.
- Discovery: find assets and exposures in that scope, including unknown and third-party ones.
- Prioritisation: rank exposures by exploitability, business impact and existing controls.
- Validation: check whether an attacker could really use them, for example with attack path analysis, breach and attack simulation or a targeted penetration test.
- Mobilisation: agree fixes with the teams that own the systems and get them done.
The tools involved
| Tool type | What it adds |
|---|---|
| External attack surface management (EASM) | Finds your internet-facing assets from the outside, including ones IT did not know about |
| Cloud security posture management (CSPM) | Checks cloud accounts for risky settings and permissions. See CSPM. |
| Cloud-native application protection platform (CNAPP) | Combines posture, workload and container security for cloud apps |
| Vulnerability prioritisation technology | Adds threat intelligence and exploit data to rank findings |
| Attack path analysis | Links weaknesses, identities and network routes to show which chains reach critical assets |
Where to start
You do not need every tool on day one. A sensible first step is to scope one important service, list its internet-facing assets from the outside, check its cloud settings and admin identities, and ask which combination would let an attacker reach its data. Even a spreadsheet version of this exercise usually finds something that a routine scan did not. Add tools when the manual effort becomes the bottleneck.
Measuring real progress
Exposure management also needs people more than tools. Mobilisation only works when system owners agree the risk is real and have time to act, so share validated attack paths with them in plain language.
Counting open vulnerabilities says little, because new ones arrive every day. Better measures include: the percentage of assets covered by scanning, mean time to remediate (MTTR) for critical findings, the share of known-exploited vulnerabilities fixed within their target time, the number of unknown internet-facing assets found, and the number of validated attack paths to critical systems over time. Report trends, not single numbers. More on reporting is in vulnerability reporting.
Real-world example: an online travel agency
A fictional online travel agency scopes its first CTEM cycle around its booking platform. External discovery finds an old marketing site on a forgotten subdomain, still running an outdated content management system. Its cloud posture tool shows that a service account used by that site has read access to the booking database backups. Neither finding ranked highly on its own, but attack path analysis shows they combine into a route to customer data. The teams take the old site down, remove the service account's access and add subdomain monitoring. The next cycle moves on to the agency's staff identity platform.
Practice
Name the five CTEM stages in order.
Why can two medium findings be more urgent than one critical one?
Why is "number of open vulnerabilities" a weak metric?
Key takeaways
- Exposure management widens vulnerability management beyond CVEs.
- CTEM has five stages: scoping, discovery, prioritisation, validation and mobilisation.
- EASM, CSPM and attack path analysis find exposures scanners miss.
- Validation checks whether an exposure is really usable by attackers.
- Measure coverage, time to fix and attack paths, not raw counts.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.