Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Security Teams Are Using Continuous Threat Exposure Management
Transcript
- Luna: Lucas, I keep hearing this term 'CTEM' pop up in security briefings — Continuous Threat Exposure Management. Is this just vulnerability management with a new coat of paint, or is there something real here? Lucas: It's more than a rebrand, though I get why you'd ask that. Traditional vulnerability management has been drowning in noise. In 2025 alone, we saw over 12 million new CVEs published — that's up from about 8 million in 2023. No team can patch everything, so most end up with a backlog that's basically a ticking time bomb. Lucas: Exactly. Gartner introduced the term back in 2022, and they've been refining it ever since. Their latest projection — from earlier this year — says that by 2027, organizations that adopt CTEM will suffer two-thirds fewer successful attacks from exposed assets. That's a big claim. Luna: Two-thirds — that's not a marginal improvement. How does it work in practice? Lucas: CTEM is a five-phase cycle: scoping, discovery, prioritization, mobilization, and measurement. The key shift is that you don't start with a scan of everything. You start by scoping what actually matters — critical assets, crown jewels, business processes that would hurt most if compromised. Luna: So instead of trying to secure the entire attack surface at once, you focus on the parts that could actually sink you. Lucas: Right. And that scoping phase is where the business context comes in. A lot of security teams skip this — they just run a scanner and get a list of vulnerabilities sorted by CVSS score. But a critical-severity flaw in a non-critical system might be less urgent than a medium-severity bug in your customer-facing payment gateway. Luna: That makes intuitive sense, but how do teams actually build that business context without a ton of manual work? Lucas: Good question. Some of the more mature teams I've talked to are integrating with their CMDB — configuration management database — and also pulling in data from their GRC platform. They create a 'business impact score' that blends the technical severity with how critical the asset is to revenue, compliance, or operations. Luna: And then the prioritization phase is about ranking based on that combined score? Lucas: Exactly. But it's not just a list — it's about identifying the exposures that are both likely to be exploited and would cause the most damage. Some teams use threat intelligence feeds to filter out vulnerabilities that aren't being actively targeted in the wild. That alone can reduce the priority list by 80 percent. Luna: Eighty percent — so you go from a mountain of work to a manageable hill. Then mobilization is actually fixing those top few. Lucas: Yes, and the mobilization phase is where you assign ownership and set timelines. Unlike traditional VM where patching might happen quarterly, CTEM aims to close critical exposures within hours or days — not weeks. One financial services company I spoke with reduced their average exposure window from 90 days to under 72 hours using this approach. Luna: Under 72 hours — that's a dramatic shift. Were they using some fancy new tool to enable that? Lucas: Surprisingly, no. They told me they didn't buy any new technology. They just changed the process. They already had vulnerability scanners, a SIEM, and a ticketing system. What they added was a weekly CTEM review where the CISO, the IT ops lead, and a business stakeholder would go through the top five exposures and decide what to fix, mitigate, or accept. Luna: So it's a governance change, not a tech purchase. That's both encouraging and a bit daunting — because it requires cross-functional buy-in. Lucas: It does. And that's where the measurement phase comes in. You track metrics like mean time to remediation, exposure window duration, and — this is key — the business impact of exposures that were successfully closed. That data becomes the ammunition for the next cycle's scoping conversation with the board. Luna: I can see why boards would respond to that. Instead of hearing 'we patched 10,000 vulnerabilities,' they hear 'we reduced the risk of a breach in our payment system by 40 percent this quarter.' Lucas: That's exactly the language that works. The CISO I mentioned earlier actually got his board to approve a 15 percent budget increase for the security team after presenting CTEM metrics for two quarters. The board saw the direct line between the security work and business resilience. Luna: Okay, but I want to push back a little. How is this different from risk-based vulnerability management, which has been around for years? Lucas: Fair pushback. RBVM does a lot of the same prioritization — using threat context and asset criticality. But CTEM is more cyclical and more integrated. RBVM often stops at prioritization and remediation. CTEM adds the explicit scoping, mobilization, and measurement phases, and it loops back continuously. It's not a one-time project; it's a program. Luna: So it's a framework that forces you to keep iterating and improving? That could be its biggest strength — or its biggest burden if teams don't have the discipline. Lucas: Discipline is exactly the challenge. But the teams that are doing it well start small. They don't try to scope the whole enterprise at once. They pick one critical business process — maybe the customer onboarding flow or the production database — and run a full CTEM cycle on that. Then they expand. Luna: I've heard of a healthcare system that started with their patient portal. They mapped all the assets supporting it, discovered a few exposures they'd missed for over a year, prioritized based on patient data sensitivity, and fixed them in a sprint. Then they moved to the billing system. Lucas: That's a textbook approach. And it builds momentum. Once the security team and the business stakeholders see the results from one cycle, it's easier to get buy-in for the next one. The key is to make the metrics tangible for each audience — technical for the ops team, financial for the board. Luna: Let's talk about the tools landscape. Are there specific vendors that enable CTEM, or is it more of a methodology you overlay on existing tools? Lucas: It's primarily a methodology, but there are platforms that help. Some of the exposure management platforms — like Tenable's ExposureAI or Qualys's VMDR — are adding ctem specific workflows. But honestly, you can start with a spreadsheet and a weekly meeting if you have the right people in the room. Luna: A spreadsheet — I love that. It keeps the focus on the process, not the tool. And if the process works, you can always invest in automation later to scale. Lucas: Exactly. And that's what Gartner's prediction hinges on — that the process improvement is what drives the two-thirds reduction, not a silver bullet tool. The technology just accelerates the cycle. Luna: Before we wrap, I want to ask about the downsides. What's the biggest pitfall you've seen with teams trying CTEM? Lucas: The biggest one is skipping the scoping phase. Some teams jump straight to discovery — they scan everything, get overwhelmed, and then try to prioritize but without a clear business context. That's just old-school VM with a CTEM sticker on it. You have to do the hard work upfront of deciding what matters. Luna: So the discipline is at the beginning. If you scope well, the rest flows. If you don't, you're back in the noise. Lucas: Right. And the second pitfall is not measuring the outcomes. If you can't show that your exposure window shrank or your business impact score improved, the board won't see the value — and the cycle breaks. Luna: That brings up something — we talk about these frameworks a lot on this show, and one thing that makes it possible is that listeners like you support us directly. We don't run ads, so the show stays focused on what's actually useful for operators and builders. A handful of folks chip in monthly through buy me a coffee dot com slash fexingo, and that's literally what funds making episodes like this one. Lucas: Yeah, it's a small group, but it makes a huge difference. Keeps us independent and lets us dig into topics like CTEM without worrying about sponsor messaging. So if you find these conversations useful for what you're building or running, that link is there — buy me a coffee dot com slash fexingo. No pressure, just a real way to keep it ad-free. Luna: Alright, back to CTEM. So if a listener wants to start next week, what's the single step you'd recommend? Lucas: Pick one critical asset — say, the authentication server or the main CRM database. Map every device, API, and user that touches it. Then run a discovery scan on just that scope, look for exposures that are actively being exploited, and fix the top three in the next five days. Measure how long it took and what the business impact was. That's your first cycle. Luna: One asset, three fixes, five days. That's manageable. And then you'll have a story to tell the CFO when you ask for more resources. Lucas: Exactly. Start small, prove the model, then scale. That's the CTEM way.