Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How CISOs Are Using Continuous Threat Exposure Management
Transcript
- Lucas: If these conversations are useful for what you're building or running, I have to say — this episode is one I've been wanting to do for a while, because the framework we're talking about might be the most practical thing a CISO can adopt right now. Luna: Okay, you've got me curious. What's the framework? Lucas: It's called Continuous Threat Exposure Management — CTEM for short. Gartner introduced the term a couple years back, but it's really crystallized in 2026 as the operating model that a lot of security teams are gravitating toward. The core idea is that instead of reacting to every vulnerability scan result or CVE alert, you continuously scope, discover, prioritize, and mobilize remediation based on actual business risk. Luna: So it's less about patching everything and more about patching the right things. I've heard some CISOs say that their teams were drowning in alerts — this sounds like a way to surface what actually matters. Lucas: Exactly. One example that stuck with me — a mid-size retailer with about 15,000 employees had their security team running a standard vulnerability management program. They were scanning on a monthly cycle, patching critical and high-severity CVEs within thirty days. But they still had two near-miss breaches in six months, both through APIs they didn't even realize were exposed. Luna: This is the classic problem — you scan what you know about, but the attack surface is always bigger than your asset inventory. Lucas: Right. So their CISO brought in a CTEM program. First phase — scoping — they defined the business-critical assets: payment systems, customer databases, the order-management API. Second phase — discovery — they used continuous monitoring tools to map every internet-facing asset, including shadow IT and cloud instances that the traditional scans missed. They found 47 exposed APIs they didn't have in their inventory. One of them was a legacy returns-processing endpoint that accepted unauthenticated requests. Luna: That's the kind of thing that keeps CISOs up at night. Did they get breached through it? Lucas: No, they caught it in discovery before any attacker did. But here's where CTEM really differs from traditional vulnerability management — the prioritization phase. Instead of assigning severity based on CVSS score alone, they used a business context engine that factored in data sensitivity, exploitability in the wild, and whether compensating controls existed. That legacy API scored a nine out of ten on business risk, even though its CVSS was only a six point five because it required some authentication knowledge. Luna: So the CVSS would have called it medium priority, but the business context made it critical. That's the gap a lot of teams fall into. Lucas: Exactly. The mobilization phase — they created a specific remediation workflow for that API: isolate it from the internet, apply a WAF rule as a stopgap, then rewrite the authentication logic within two weeks. The measurement phase tracked mean time to remediation, which dropped from 28 days to 17 days across the board within three months. Luna: And I imagine the CISO could show the board a tangible reduction in risk exposure, not just a patching statistic. Lucas: That's the real win. Gartner actually published a prediction that organizations adopting CTEM will experience two-thirds fewer successful exploits from their attack surface by 2027. And when you think about it, that makes sense — you're not trying to patch everything, you're trying to close the gaps that matter most. Luna: So how does a team actually get started? I imagine it's not a rip and replace of existing tools. Lucas: No, it's more of an operational shift. You need tools that feed into a continuous discovery process — things like attack surface management platforms, cloud security posture management, and API security tools. But the key is the prioritization engine that ties vulnerability data to business context. Some teams build it themselves using a risk register and a spreadsheet, but there are commercial platforms now that integrate with your existing scanners and ticketing systems. Luna: I've heard that some CISOs are using the CTEM framework to justify headcount too — because you can show the board that with a given team size, you can only remediate a certain number of high-risk exposures per quarter, so you need more people or automation. Lucas: That's a great point. And actually, this is where a lot of security leaders are investing their budget right now. Quick honest thing — a handful of listeners chip in monthly through buy me a coffee dot com slash fexingo, and that's literally what funds making episodes like this one, where we can dig into these operational details without any sponsor influence. Luna: Yeah, it's part of what lets us keep the conversation focused on what actually works. And I know for a fact that some of those supporters are CISOs themselves who say these episodes help them frame their own strategies. Lucas: So back to CTEM — one of the underappreciated phases is the mobilization step. It's not enough to know what's critical; you have to have a process that gets the right team to act on it. That means integrating with your existing ticketing system, defining SLAs based on risk level, and automating as much of the remediation as possible. Luna: For example, if a critical exposure is found on a cloud workload, can you automatically apply a firewall rule or isolate the instance? Lucas: Exactly. Some teams have built automation that, when a CTEM platform flags a critical API exposure, it automatically creates a Jira ticket, assigns it to the API owner, and blocks the endpoint at the WAF level until a permanent fix is deployed. That kind of automation can bring mean time to remediation down from weeks to hours for the most critical items. Luna: But I imagine there's a cultural challenge too — developers might push back if they feel like security is blocking their deployments without enough context. Lucas: That's where the measurement phase comes in. CTEM includes a feedback loop where you track not just remediation time but also the number of false positives and the business impact of each block. When you can show developers that the automated block prevented a data exposure that would have cost millions, they start to buy in. One CISO I spoke with said that after six months, his development teams were actually requesting to be included in the CTEM scoping phase because they wanted to know which assets were considered business-critical. Luna: That's the holy grail — security becomes an enabler instead of a bottleneck. Lucas: Exactly. And I think that's why CTEM is gaining traction so quickly. It's not just a tool or a process; it's a way to align security operations with business objectives. The five phases — scoping, discovery, prioritization, mobilization, measurement — give you a repeatable cadence that you can tune over time. Luna: So if a listener is a CISO or a security manager, what's the first step they should take tomorrow? Lucas: I'd say start with the scoping phase. Pick your three most critical business processes — maybe it's payment processing, customer data access, and intellectual property management. Map every asset that touches those processes, including cloud workloads, APIs, and third-party integrations. You'll almost certainly find something you didn't expect. Luna: And then you can apply the CTEM framework to those assets as a pilot before rolling it out to the whole organization. Lucas: Right. And that's exactly what the retailer I mentioned did. Their pilot covered just the payment and order-management systems. After three months, they had reduced their critical exposure count by 60 percent and had a blueprint for scaling to the rest of the business. Luna: That's a pretty compelling ROI. Thanks for breaking this down, Lucas — I think a lot of listeners will walk away with something actionable. Lucas: Glad to do it. CTEM is one of those frameworks that sounds like common sense once you hear it, but putting it into practice is where the real value shows up.