Continuous Threat Exposure Management (CTEM) & Fix Validation
Prioritises exposures by exploitability, drives fixes to owners, and proves they worked.
Overview
Continuous Threat Exposure Management (CTEM) runs exposure reduction as a programme through Gartner's five stages (scoping, discovery, prioritization, validation and mobilization) instead of a scan-and-ticket loop. Tools here sit above the scanners: they pull vulnerabilities, misconfigurations and identity exposures from many sources, rank them by attack path and exploitability against critical assets, route fixes to owners with SLAs, and re-test to prove a fix actually closed the exposure. Scanning itself belongs to Vulnerability Management, control-efficacy emulation to BAS, internet-facing discovery to ASM, and human-led testing to Penetration Testing & Bug Bounty. Commercial platforms are SaaS subscriptions, mostly quote-only and scaled by asset or finding volume, and Microsoft includes its module in E5-class licences. Open source covers the aggregate, dedupe, track and SLA half well (OWASP DefectDojo) but not attack-graph prioritization or exploit-based retesting.
Matters once findings outnumber the people fixing them; retesting is what makes 'closed' mean fixed.
Advantages
- Attack-path and choke-point analysis shrinks the fix list to exposures that actually reach critical assets
- One deduplicated queue across scanner, cloud, AppSec and identity findings, routed to named owners with SLAs
- Fix verification (rescan auto-close or targeted retest) turns 'ticket closed' into evidence the exposure is gone
- Compensating-control and alternative-mitigation guidance gives a path when a patch is impossible or delayed
- Low-cost entry points: Microsoft's module is included for Microsoft 365 E5 tenants and OWASP DefectDojo is free
Trade-offs
- Only as good as the scanner, CMDB and ownership data feeding it; poor asset data yields confidently wrong priorities
- Overlaps scanner vendors' own exposure suites (Tenable One, CrowdStrike, Microsoft), risking paying twice
- Rescan-based closure only proves a scanner stopped seeing the issue; exploit-based retests cover a narrower scope
- Mostly quote-only and priced on asset or finding volume that grows with the estate
- Rapid consolidation (Vulcan Cyber to Tenable, PlexTrac to Brinqa, CrowdStrike's pending purchase of XM Cyber's IP) adds roadmap risk
Open-source option
OWASP DefectDojo (BSD-3-Clause, Flagship, actively maintained) aggregates and dedupes findings from hundreds of tools, tracks SLAs, pushes to Jira and auto-closes findings missing from a re-imported scan. Nothing open source matches commercial attack-graph prioritization or exploit-based fix retesting; Faraday Community (GPL-3.0) is a pentest-team findings hub rather than a CTEM platform.
Vendors & tools in this area
Attack-graph CTEM: chains CVEs, misconfigs and identity exposures to find choke points; CrowdStrike agreed in Jul 2026 to buy its IP.
Visit site →Exposure management platform over Tenable's own sensors plus third-party data; absorbed Vulcan Cyber (closed Feb 2025).
Visit site →Exposure graph, attack paths and choke points in the Defender portal; included with Microsoft 365 E5, third-party data via connectors.
Visit site →Autonomous pentesting that proves exploitable paths; 1-Click Verify re-tests selected weaknesses to confirm fixes actually worked.
Visit site →Unified exposure management: aggregates 260+ sources into a risk graph, routes fixes to owners; PlexTrac (acq. Aug 2026) adds retesting.
Visit site →Vulnerability and exposure management system of record: 200+ connectors, automated owner routing and SLA tracking; FedRAMP Moderate.
Visit site →Remediation operations for CTEM: groups findings by fix, maps owners and pushes deduplicated work into Jira, ServiceNow or Azure DevOps.
Visit site →Open-source findings hub: parses 500+ report types, dedupes, tracks SLAs and Jira tickets; reimport auto-closes findings no longer seen.
Visit site →