CTEM in Practice: Five Stages From the Outside In

Continuous threat exposure management (CTEM) is a program that repeats one short cycle: scope, discover, prioritize, validate and mobilize. Gartner describes it as a five-step process in an article dated 21 August 2023, and it listed CTEM among its top 10 strategic technology trends for 2024. This post walks through the five stages and shows what data each one needs, with a focus on what you can see from outside your network.

What CTEM changes about exposure work

From scan-and-patch lists to a repeating program

Gartner says attackers pivot fast, and that automating controls and deploying patches does not reduce future exposure. It asks instead for a program that “surfaces and actively prioritizes whatever most threatens your business”. The aim is not to fix every issue. The aim is to fix the ones that matter first, and to do it again next month.

Gartner research published in August 2025 puts it as a move from traditional vulnerability management to a broader and more dynamic CTEM program. So CTEM is not a new scanner. It is a way to run the work around scanners.

Where EASM, vulnerability management and threat intel sit inside it

This mapping is our reading, not Gartner’s. Vulnerability management mostly covers known flaws on known assets, so it sits in stages 3 and 5. External attack surface management (EASM) feeds stages 1 and 2 from the outside. Threat intelligence adds the evidence for stages 3 and 4: who is exploiting what, and who is talking about your assets.

That also answers a common question. CTEM is a program, and tools support it. You can start a first cycle with the scanners you already own, plus outside-in data on what the internet can see of you.

Stage 1: Scoping, starting with what attackers can reach

Gartner tells teams to scope the attack surface beyond the focus of typical vulnerability management. It names corporate social media accounts, online code repositories and integrated supply chain systems as parts of that surface, next to devices and applications.

External scope first: domains, subsidiaries, cloud, third parties

For a first pilot, Gartner suggests two areas. One is the external attack surface, which it calls a relatively narrow scope with a growing ecosystem of tools. The other is SaaS security posture. We start outside because the data is easy to collect without touching your systems.

• Root domains, including those that came with an acquisition.
• Subsidiaries and brands that run their own sites.
• Cloud accounts and SaaS tenants.
• Suppliers that host or touch your data.

Outside-in data for this stage is public: certificate logs, DNS records, WHOIS and web crawl data. The CISO owns the scope, with IT and business owners agreeing to it.

Stage 2: Discovery of assets and exposures

Gartner warns that confusion between scoping and discovery is often the first failure in a CTEM program. A long list of discovered assets is not success. Discovery should cover visible and hidden assets, vulnerabilities, misconfigurations and other risks inside the scope you chose.

Unknown assets and shadow IT

Take a made-up bank, examplebank.com. A team launched old-portal.examplebank.com for a campaign two years ago and never took it down. It is in scope as a subdomain of a known domain, but it is on no inventory. Discovery is the stage that finds it.

The asset discovery and shadow IT use case describes how forgotten subdomains, cloud storage and SaaS accounts show up this way, and how each is linked to an owner.

Leaked credentials and lookalike domains as exposures, not only CVEs

Not every exposure has a CVE number. A staff login in a stealer log is an exposure. So is a fake domain that copies your brand to catch customers. Both fit the wider scope Gartner describes, and both are outside-in findings. Dark web monitoring and lookalike domain detection are the usual sources.

Stage 3: Prioritization with threat context

Gartner says prioritization should factor in urgency, the availability of compensating controls, tolerance for residual attack surface and the level of risk to the organization. It adds that the key is to identify the high-value assets of the business and focus the treatment plan on them.

CVSS, EPSS and CISA KEV as signals

Three public signals help. CVSS describes how severe a flaw is. EPSS, from FIRST, estimates the probability that a published CVE will be exploited in the wild in the next 30 days, as a score from 0 to 1. The CISA Known Exploited Vulnerabilities (KEV) catalog lists flaws already exploited, and CISA says organizations should use it as an input to their prioritization framework. Our post on CVSS, EPSS and KEV compares them side by side.

Is anyone selling access or talking about this asset?

None of those three signals tells you whether criminals are interested in your company right now. That evidence sits in underground forums and markets. Brandefense vulnerability intelligence watches exploit chatter and proof-of-concept circulation, and filters it against the tech stack you declare. A flaw that is on KEV, reachable from the internet and discussed by attackers goes to the top of the list.

Stage 4: Validation

Confirm reachability and exploitability before raising a ticket

Gartner describes validation as three jobs. Confirm that attackers could really exploit the flaw. Analyze the attack paths to the asset. Check whether the current response plan is fast and substantial enough to protect the business. It also says stakeholders must agree on what triggers a fix.

Outside-in checks are cheap here. Does the service answer from the internet? Is the version the one the scanner reported? Does the asset really belong to you? A ticket with that proof is easier to act on than a raw scanner line.

Stage 5: Mobilization

Gartner says you cannot rely wholly on automated remediation, although it may suit obvious and unobtrusive issues. Instead, communicate the CTEM plan to the security team and to business stakeholders, and document cross-team approval workflows. The goal is to remove obstacles to approvals, implementation and mitigation.

Owners, deadlines and the board view

Every confirmed exposure needs an owner and a date. NIST SP 800-40 Rev. 4, published in April 2022, defines enterprise patch management as identifying, prioritizing, acquiring, installing and verifying patches. It recommends an enterprise strategy to simplify and operationalize patching. Re-check from outside after the fix, and close the item only then.

For the board, count what changed. Two measures work well: exposures closed, grouped by business impact, and the time from discovery to validation. The exposure management role page lists what these teams ask for.

A first 90-day CTEM cycle

This plan is our suggestion, not a Gartner template. It fits 13 weeks, and every output feeds the next stage.

Back to examplebank.com. In weeks 3 and 4 the old portal is found. In weeks 5 and 6 it ranks high because a flaw in the software version it runs is listed in the KEV catalog. In weeks 7 and 8 a check from outside confirms the login page is open to the internet. By week 11 the team that owns the campaign has taken it down, and the team checks from outside that it is gone.

The Gartner, CISA, FIRST and NIST pages cited here were last checked against sources on 19 October 2026.

Want to see what an attacker can reach on your own domains today? Request a demo or start with a free Atlas scan. A buyer’s view of the tools is in our attack surface management buyer’s guide.