The short answer
CTEM, or continuous threat exposure management, is a security programme model introduced by Gartner in 2022. It runs in five repeating stages: scoping, discovery, prioritisation, validation and mobilisation. Rather than patching by severity score alone, it focuses effort on the exposures an attacker could actually use against the systems that matter most.
On this page
- What does continuous threat exposure management mean?
- What are the five stages of CTEM?
- How is CTEM different from vulnerability management?
- Where do penetration testing and red teaming fit in CTEM?
- What does a CTEM cycle look like in practice?
- How does CTEM relate to ASM, BAS and SIEM?
- Does CTEM help with compliance?
- Why Sovereign Secure?
CTEM (continuous threat exposure management) is a way of running security as a repeating cycle instead of a once-a-year test or an endless patch queue. Each cycle picks part of the business, finds what is exposed there, ranks it by real-world risk, proves which weaknesses an attacker could use and drives the fixes through. Gartner introduced the model in 2022. It is a programme you run, not a product you buy. For related terms, see the cyber security glossary.
What does continuous threat exposure management mean?
An exposure is anything an attacker could use to reach something you care about. That includes software vulnerabilities, but also misconfigured cloud services, weak or over-privileged identities, forgotten internet-facing systems, leaked credentials and risky supplier connections. CTEM asks two questions about each one: does it lead to something that matters, and can it really be exploited? Only exposures that pass both get urgent attention.
What are the five stages of CTEM?
| Stage | Question it answers | Typical inputs |
|---|---|---|
| 1. Scoping | Which part of the business are we looking at this cycle? | Critical services, sensitive data, internet-facing systems, SaaS, suppliers |
| 2. Discovery | What assets and exposures exist in that scope? | Asset inventories, attack surface discovery, vulnerability scans, configuration and identity reviews |
| 3. Prioritisation | Which exposures matter most? | Exploit likelihood, threat intelligence, business impact, existing controls |
| 4. Validation | Could an attacker really use it, and would we notice? | Penetration testing, red teaming, attack simulation |
| 5. Mobilisation | How do we get it fixed and agreed? | Owners, deadlines, change processes, accepted risks, retests |
Scoping is what stops CTEM becoming another unmanageable list. Many organisations start narrow, with their internet-facing systems, where external attack surface management feeds discovery. Prioritisation goes beyond severity scores: EPSS estimates how likely a vulnerability is to be exploited, and business context says whether the affected system matters. Mobilisation recognises that most fixes belong to someone outside the security team, so owners and deadlines are agreed rather than imposed.
How is CTEM different from vulnerability management?
Vulnerability management finds and fixes known software flaws on known assets. CTEM is broader, starts from business priorities and adds proof of exploitability.
| Aspect | Vulnerability management | CTEM |
|---|---|---|
| What it covers | Known vulnerabilities and missing patches | Any exposure: vulnerabilities, misconfigurations, identities, exposed data, third parties |
| Starting point | Assets the scanner can see | Business priorities, including assets nobody has listed |
| How it ranks | Mainly severity scores | Exploitability, attack paths and business impact |
| Proof | Scanner output | Testing whether the exposure can be used |
| Output | Patch tickets | Agreed fixes across teams, confirmed by retest |
CTEM does not replace vulnerability management; discovery depends on it, and the fixed patching deadlines in Cyber Essentials and PCI DSS still apply. The NCSC’s vulnerability management guidance remains a sound base for that part of the cycle.
Where do penetration testing and red teaming fit in CTEM?
They are the validation stage. A penetration test shows whether a prioritised exposure can actually be exploited, and often chains several low-rated issues into one serious attack path. Red team assessments go further and test whether your detection and response would catch a realistic attack. A retest then closes the mobilisation stage by proving each fix worked.
CTEM runs in cycles, so validation has to keep pace, usually through smaller scoped tests and retests spread across the year rather than one large annual engagement. Our guide to penetration testing as a service compares the delivery models. Between human-led tests, breach and attack simulation (BAS) tools can replay known attack techniques automatically to check that controls still block and detect them.
What does a CTEM cycle look like in practice?
An illustrative cycle for a business that sells online:
- Scoping: the customer website, its checkout and the cloud account behind them.
- Discovery: attack surface discovery turns up a forgotten staging copy of the site on a public subdomain.
- Prioritisation: the staging site runs out-of-date software and holds a copy of real customer data, so it outranks higher-scored findings on internal test machines.
- Validation: a penetration test confirms the outdated component can be exploited to read that data.
- Mobilisation: the web team agrees to take the staging site offline within a week, and a retest confirms it has gone.
How does CTEM relate to ASM, BAS and SIEM?
CTEM is the programme; most of the tools and services sold alongside it fit one stage. A SIEM is the exception: it sits outside the cycle, detecting attacks rather than reducing exposure.
| Term | What it does | Where it fits |
|---|---|---|
| Attack surface management | Finds internet-facing assets and exposures, including ones nobody listed | Discovery |
| Vulnerability scanning | Checks known assets for known flaws on a schedule | Discovery |
| CVSS and EPSS | Rate a vulnerability’s severity and the likelihood it will be exploited | Prioritisation |
| Penetration testing and red teaming | Prove whether an exposure can be exploited and whether you would detect it | Validation |
| Breach and attack simulation | Replays known attack techniques to check controls still block and detect them | Validation |
| SIEM (security information and event management) | Collects and correlates logs to detect attacks in progress | Outside the cycle; detection gaps found during validation become new SIEM rules |
The difference between CTEM and SIEM is timing: CTEM shrinks what an attacker could use before an attack, while the SIEM, and the people watching it, spot attempts on whatever exposure remains.
Does CTEM help with compliance?
It can supply evidence, but it does not change what standards require. PCI DSS v4.0.1 still requires internal and external penetration tests at least once every 12 months and after significant changes, along with quarterly internal and external vulnerability scans, the external ones by a PCI SSC Approved Scanning Vendor. In ISO 27001:2022, a CTEM programme supports Annex A controls such as 5.7 (threat intelligence), 5.9 (inventory of information and other associated assets) and 8.8 (management of technical vulnerabilities), but certification depends on the whole management system.
Why Sovereign Secure?
Our part in CTEM is independent evidence for the discovery and validation stages. Sovereign Secure provides vulnerability scanning, web, API, network, cloud and mobile penetration testing, red team assessments and retests. As a PCI SSC Qualified Security Assessor company that is ISO 27001 certified, we map findings to the standards you are assessed against.
Next step: request a penetration testing quote for the validation stage of your next cycle.
Your next step
- Scope your testChoose your test types and asset counts online to scope your penetration test.Scope your test
- Pen testing cost guideUK day rates, price ranges by test type and what drives the cost.Read the cost guide
- Talk to a testerTell us what you need tested. We aim to reply within one working day.Talk to a tester
Last reviewed October 2026 by the Sovereign Secure assessment team.
