CTEM and Exposure Management Explained for IT Teams

Continuous threat exposure management (CTEM) is a five-stage program, introduced by Gartner in 2022, for finding the weaknesses an attacker could use against you, ranking them by whether they are reachable and exploitable, proving the fix worked, and running the loop again. It replaced the older habit of exporting a scanner report, sorting it by CVSS score and hoping the top of the list gets patched before the bottom becomes a breach. This guide explains what CTEM is, how it differs from vulnerability management and attack surface management, which platforms sell it, and how an IT team runs the loop with the tools it already owns.

TL;DR

• What CTEM is. A five-stage loop (scoping, discovery, prioritization, validation, mobilization) that treats exposures, not CVE counts, as the unit of work.
• How it differs. Scanners find CVEs, attack surface tools find assets, CTEM decides which findings matter and proves they got fixed.
• Who sells it. CrowdStrike, Microsoft, Tenable, Rapid7, Qualys, XM Cyber and Cymulate, mostly as quoted add-ons.
• How to start. An inventory, an external scan, one KEV-plus-EPSS rule and a patch tool with rings.

What CTEM Is and Where It Came From

Gartner's 2022 paper "How to Manage Cybersecurity Threats, Not Episodes" named the problem: security teams were running vulnerability programs as a series of scan-and-report episodes, while attackers worked a continuous process of finding one reachable weakness. CTEM was the answer, a program rather than a product, and the vendors adopted the term within a year. CrowdStrike's CTEM explainer draws the contrast in four rows: continuous versus scheduled cadence, exposure-focused versus CVE-focused, process-driven versus scanner-driven, and a scope that covers misconfigurations, identity risks and external exposure rather than software flaws alone.

The word "exposure" is doing the work in that definition. A vulnerability is a flaw in a piece of software. An exposure is any condition an attacker can use: the flaw, but also the open RDP port, the service account with a password from 2019, the forgotten subdomain pointing at a decommissioned server, and the backup appliance nobody put in the asset register. CTEM programs count exposures because that is what gets exploited. The Verizon 2025 Data Breach Investigations Report, drawn from 12,195 confirmed breaches, put exploitation of vulnerabilities at 20% of initial access, up 34% year on year, with the growth concentrated in zero-days against perimeter devices and VPNs. Those are exactly the exposures a scheduled internal scan sees last.

The US federal government moved the same way in 2026. CISA's Binding Operational Directive 22-01, which since 2021 had set fixed deadlines for anything on the Known Exploited Vulnerabilities catalog, was revoked on 10 June 2026 and replaced by BOD 26-04, "Prioritizing Security Updates Based on Risk". The new directive sets remediation timelines from four variables: whether the asset is publicly exposed, whether the CVE is on the KEV catalog, whether exploitation can be automated, and whether the attacker gains partial or total control. That is a CTEM prioritization model written into federal policy, and it is a reasonable template for a private IT team too.

The Five Stages of a CTEM Program

Each stage has one thing it needs from you, and the program stalls at whichever stage lacks it. CrowdStrike's explainer summarises the five needs as an accurate current asset inventory, continuous exposure insight, exploitability plus business context, realistic attack-path analysis, and automated cross-team remediation. In practice they look like this.

Scoping decides what the program covers this cycle. Not everything: the external attack surface and the systems that process payments or run production are the usual first scope, because that is where exposure meets consequence. Scoping fails without an inventory, which is why IT inventory tooling turns up at the start of every CTEM project.

Discovery finds the exposures inside the scope: CVEs, misconfigurations, exposed services, weak identities, shadow assets. A vulnerability scanner is one discovery source. Cloud posture tools, identity audits and external scans are others, and the point of CTEM is that they feed one list rather than four.

Prioritization ranks that list by exploitability and business context rather than severity alone. This is the stage that changes behaviour, and the one the rest of this guide spends the most time on.

Validation checks whether the exposure is reachable in your environment. A CVSS 9.8 on a server with no route from the internet and no credentials in reach is a lower priority than a 6.5 on the VPN concentrator. Attack-path analysis and breach-and-attack simulation tools exist for this step; a tabletop with a network diagram is the manual version.

Mobilization gets the fix done, which means handing a prioritized, validated list to whoever owns the patch tool, the firewall or the identity provider, with approval steps that do not take three weeks. Security finds; IT fixes. Programs that skip this stage produce excellent reports and unchanged risk.

CTEM vs Vulnerability Management vs Attack Surface Management

The three terms overlap enough that vendors use them interchangeably in marketing and buyers end up comparing a process to a feature. The table separates them by the question each one answers.

Vulnerability management is a component of CTEM, not a competitor to it. If you run a scanner and a patch cadence today, you already have the discovery and mobilization stages for one class of exposure. Vulnerability management software covers the scanner side of that in detail.

Attack surface management is also a component: it feeds scoping and discovery with the assets you did not know about, which an internal scanner can never find because it was never pointed at them. The explainer on what an attack surface is covers mapping and shrinking it.

What CTEM adds on top is the two stages in the middle, prioritization and validation, and the discipline of running all five as a loop. A team can adopt that without buying anything, which is why practitioners keep saying the program matters more than the platform.

Why CVSS Alone Fails the Prioritization Step

CVSS measures how bad a flaw would be if exploited. It says nothing about whether anyone is exploiting it, or whether your copy is reachable. A ranking by CVSS therefore puts a 9.8 on an isolated print server above a 7.5 that ransomware crews are using this week against VPN appliances. The 2025 DBIR's finding that ransomware appeared in 44% of breaches, up 37%, is the cost of that ordering. The guide to CVE, CVSS and the NVD explains how the scores are built and why they were never meant to be a patch queue.

Two public feeds fix most of the problem for free. CISA's Known Exploited Vulnerabilities catalog lists CVEs with confirmed exploitation in the wild; its 6 November 2026 release holds 1,769 entries, a short list against the tens of thousands of CVEs in the NVD.

FIRST's Exploit Prediction Scoring System gives every CVE a daily probability, from 0 to 1, that it will be exploited within the next 30 days. FIRST's own EPSS FAQ is careful to say it is not a complete risk score, because it has no view of your environment. That is the point: KEV and EPSS supply the exploitability half of prioritization, and your inventory supplies the context half.

The r/cybersecurity thread above, from September 2025, reached 66 comments on the same complaint, and the practitioner consensus was consistent: rank by exposure, not score. The rules the commenters converged on were whether the asset is internet-facing, whether there is a reachable path to it, whether the CVE is on KEV or has active exploitation, and how critical the asset is to the business. Several warned against buying a platform to do that ranking before the team had tried it with a spreadsheet and the two feeds above, because the platform's output is only as good as the inventory it is given.

A working rule for an IT team of any size: patch anything on KEV within the directive-style window your policy sets, patch anything with an EPSS score above 0.1 on an internet-facing or identity-bearing asset in the next cycle, and let everything else ride the normal monthly cadence. The thresholds are yours to tune. The structure, exploitability first and context second, is what makes the list short enough to finish.

The Exposure Management Platform Landscape

Every major security vendor now sells an exposure management layer, usually as an add-on to a platform you already pay for, so the shortlist is often decided by which agent is already on your endpoints. The table summarises the main options as of November 2026, from each vendor's public documentation.

Two patterns matter more than any row. First, the platform vendors (CrowdStrike, Microsoft, Tenable, Rapid7, Qualys) sell CTEM as a view over data their agents already collect, so the licence question is "what does the add-on cost on top of what I pay" rather than "what does a new product cost". Second, the standalone vendors (XM Cyber, Cymulate) sell the validation stage specifically, attack-path analysis and adversary emulation, and expect to sit on top of someone else's scanner.

CrowdStrike's version illustrates the first pattern. Falcon Exposure Management is a quoted add-on to the Falcon bundles, and the Network Vulnerability Assessment piece is free for 10% of your licensed assets, per CrowdStrike's Exposure Management page read in November 2026. Its ExPRT.AI rating is the vendor's answer to the KEV-plus-EPSS rule above: a model that re-ranks CVEs on observed exploitation, adversary interest and asset context. The review of CrowdStrike vulnerability management covers Spotlight and ExPRT.AI in detail. The video below is CrowdStrike's own 2026 lightboard walk-through of operationalising the five stages on that platform, and it is a useful six minutes even if you run a different stack, because the stages are the same.

Microsoft's version is the one to check first if you are on E5, because it may already be switched on. Microsoft's prerequisites page lists Microsoft 365 E5, E3 with certain add-ons, and the Defender suite licences, and notes that the full dashboard needs Defender for Cloud CSPM and Defender Vulnerability Management enabled. Connectors that pull in non-Microsoft tools are in preview with consumption-based pricing per asset retrieved, so the "included" label applies to the Microsoft estate and not necessarily to the rest of your inventory.

For the list price context on the CrowdStrike side: the published Falcon bundles run $59.99 for Go, $99.99 for Pro and $184.99 for Enterprise per device per year on CrowdStrike's pricing page, read in November 2026, and Exposure Management is quoted on top of whichever bundle you hold. The full breakdown is in the guide to CrowdStrike pricing.

Mobilization: Where the Fix Lands

Prioritization produces a short list. Mobilization is the handoff from the team that built the list to the team that owns the change, and it is where CTEM programs most often stall, because the exposure platform and the patch tool are usually different products with different owners. The practical test of a CTEM stack is whether a validated exposure becomes a patch job, a firewall rule or an identity change without someone re-typing it into a ticket.

The patch side has moved toward the exposure side in the last year. CrowdStrike's Falcon for IT announced risk-based patching on 17 September 2025, with ExPRT.AI ratings driving the patch priority and Patch Safety Scores and deployment rings controlling the rollout, so the same console that ranks the exposure can push the fix to the Falcon sensor. The Falcon for IT review covers what shipped and what was still disclaimed as unreleased. Microsoft's equivalent is Intune and Defender Vulnerability Management's remediation requests. Tenable's is its remediation orchestration layer.

The worked case from October 2026 is PHP2Shell, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October with a CVSS of 9.2. Under a CVSS-only program it is one of 1,413 CVEs CrowdStrike counted in that month's Patch Tuesday analysis. Under a CTEM program it is scoped (which hosts run the affected PHP build), discovered (the scanner or sensor finds them), prioritized (PHP sits on internet-facing web servers, and a 9.2 on an exposed web tier draws attackers fast), validated (which of those hosts are reachable from outside), and mobilized (patch the reachable ones first, the rest in the cycle). CrowdStrike published a detection-and-remediation walkthrough on 31 October 2026 showing exactly that sequence on its own tooling, and the CrowdStrike patch management guide covers where a separate RMM still fits in that flow.

For teams whose patch tool is an RMM rather than a security console, mobilization means the RMM has to accept a prioritized list and act on it by ring. OpenFrame does this with its own RMM and an AI layer that drafts the patch job from the exposure list for a technician to approve, at $1 per device per month including 10 million AI tokens, per the OpenFrame pricing page. The AI drafts and the technician decides, which is the right division of labour for a change that can take a server down. Flamingo builds OpenFrame, which competes with some of the tools covered here.

Running CTEM Without a Platform

A CTEM program needs five stages, not a seven-figure licence, and the practitioners who have run one say the same thing in different words: start small, start external, use what you have. The r/cybersecurity thread below, from April 2026, asked what the first 90 days looked like for teams that had done it.

The answers were practical. Do not wait for a perfect inventory, because you will never have one; start with the assets you can see from the internet and the identities that can reach them. Do not try to boil the ocean; pick one scope, run the loop once, and widen it. And do what you can with existing tools before buying, so that when you do evaluate a platform you know which stage you are paying it to improve. A 90-day plan built from that advice looks like this.

1. Weeks 1 to 2, scoping. Pull the inventory you have from the RMM, Intune or the scanner, reconcile it against DNS and the cloud consoles, and pick the first scope: everything internet-facing plus the identity provider.
2. Weeks 3 to 6, discovery and prioritization. Run an external scan, pull KEV and EPSS, and write the ranking rule: KEV first, then EPSS above 0.1 on in-scope assets, then the rest by cadence.
3. Weeks 7 to 10, mobilization. Set up ring-based deployment in the patch tool, with a pilot ring, a broad ring and a servers ring, and give the exposure list a standing slot in the change calendar. The patch management software roundup covers which tools do rings well.
4. Weeks 11 to 13, validation and the second loop. Rescan, confirm the prioritized fixes landed, measure the time from KEV listing to patch, and widen the scope for cycle two.

None of this needs a new product. It needs an inventory you trust, two free feeds, a patch tool with rings, and a calendar entry that does not get bumped. Those are the same four things a platform would ask you for before it could do anything useful.

A Worked Example: 400 Endpoints, One Patch Tuesday

Numbers make the prioritization argument concrete, so here is a planning model for a 400-endpoint organisation working through October 2026's Patch Tuesday. The only measured figure is the starting count: CrowdStrike's analysis of that month counted 1,413 CVEs across the vendors it tracks. Every other number below is a planning assumption, labelled as such, and you should replace each one with your own data on the first loop.

Assume 10% of those CVEs apply to software present in your estate, which gives 141 relevant CVEs. Assume 15% of those are on KEV or carry an EPSS score above 0.1, which gives 21 exploitable ones. Assume a third of those sit on internet-facing or identity-bearing assets in scope, which gives 7 exposures for the priority ring this cycle. The other 134 relevant CVEs are not ignored; they ride the normal monthly cadence, and the patch tool handles them in bulk.

The change in workload is the point. A CVSS-sorted list of 141 items is a month of triage with no clear finish line. A validated list of 7 is a Tuesday afternoon, and the measurement at the end of the cycle (did all 7 land, and how many days after KEV listing) is a number you can report to leadership and improve next month. The same model scales: a 4,000-endpoint estate with the same assumptions has 70 priority exposures, which is still a week of work rather than a quarter.

Who CTEM Fits

CTEM fits any IT team that has more findings than hours, which is every team with a scanner. The program itself costs nothing beyond the discipline to run five stages in order and the inventory to run them against. The platform decision is separate, and it has a clear shape.

A platform is worth quoting when the team already runs the vendor's agent and the add-on would replace a spreadsheet, a separate external scanner and manual KEV checks with one view. That is the CrowdStrike, Microsoft, Tenable, Rapid7 and Qualys case, and on E5 the Microsoft version may already be licensed. A standalone validation tool, XM Cyber or Cymulate, is worth evaluating when the team has the first three stages working and the open question is which of the remaining exposures are reachable in practice. Teams below that line, with an RMM and a scanner and no exposure platform, lose nothing by running the 90-day plan first; the inventory and the ranking rule carry straight into any platform they buy later.

The teams it fits least are the ones who buy the platform to skip the inventory. Every stage of CTEM assumes you know what you have, and no vendor's console fixes that from the outside.

The Short Answer and What to Read Next

CTEM is the five-stage loop, not the licence. Scope what matters, discover the exposures, rank them by KEV, EPSS and reachability rather than CVSS alone, validate the ones that are reachable, and hand a short list to the team that owns the fix with the authority to ship it. Platforms from CrowdStrike, Microsoft, Tenable, Rapid7, Qualys, XM Cyber and Cymulate automate stages of that loop; none of them supplies the inventory or the cadence, which are the parts that decide whether the program works.

To go deeper on the components, the guide to Patch Tuesday covers the monthly cadence the mobilization stage hangs on, the CVE and CVSS explainer covers the scoring the prioritization stage improves on, and the vulnerability management roundup covers the scanners that feed discovery. If your stack is CrowdStrike, the vulnerability management and Falcon for IT reviews linked above cover the exposure and patching sides in detail.

Keywords: ctem, continuous threat exposure management, exposure management, what is ctem, ctem framework, ctem gartner, exposure management vs vulnerability management, attack surface management, ctem tools, exposure management platforms