What is “Continuous Threat Exposure Management” in Gartner’s 2022 Hype Cycle

Every professional wants to know what’s new and exciting in the industry, and cybersecurity folks are no different. Yes, we can be more suspicious and prudent. Still, the nature of our business is so dynamic that, if we don’t consider considering new technologies and approaches, we might tumble into a total loss of control faster than we think. 

What is Continuous Threat Exposure Management (CTEM)? 

Continuous Threat Exposure Management (CTEM) is a program. 

Not a new tool. Not a technology. Don’t google “continuous threat exposure management vendors” – it’s a 5-stage program. The rationale behind adopting this concept and rolling it out in your organization is straightforward: 

Continuously plan, monitor, and reduce your level of risk using validation technologies that prompt prioritized remediation actions based on the business context, so executives understand and engage. 

Gartner predicts that organizations that adopt this model will be far less likely to be breached. 

That’s it. You can stop reading now.  

Unless, that is, if you want to understand these five stages better, why you really should think about adopting the CTEM program and how to do so appropriately. 

The five stages are: 

1. Scoping – The first step in an exposure management program is, naturally, scoping the exposure. This is done by mapping the external attack surface and the risks associated with SaaS and software supply-chain. It requires a collaboration between the business and the security functions to define (or refine, in later iterations) what is mission-critical, high value, or sensitive, and the business objectives to support it. 
2. Discovery – consists of mapping the infrastructure, network, applications, and sensitive data assets, to find misconfigurations, vulnerabilities, and another tech/logic/process flaws and classify their respective risk.  
3. Prioritization – CTEM advocates evaluating the likelihood of exploitability – with or without regard to compensating controls – as the basis to grade their relative importance. Where the exploitability likelihood is low, the security gap is scored as a low priority and could be postponed if sufficient remediation resources are unavailable. 
4. Validation – Launch simulated or emulated attacks on the previously identified exposures to evaluate the efficacy of existing defenses, and validate that the immediate response and remediation are adequate, making sure to leverage initial foothold gains to test the attacker’s ability to exploit lateral movement routes to the critical assets. This stage requires using a large variety of techniques to assess the efficacy of both security controls and procedures. 
5. Mobilization – Taking corrective measures and actions deriving from business implications of the validation’s outcomes. It is usually done manually and within the local context. As CTEM depends much on collaboration, the remediation operationalization is expected to be near-frictionless and generate comprehensive information formatted to optimize rescoping for the subsequent cycle.  

 Ultimately, CTEM is about security posture optimization. Its continuous nature allows quick remediation and applying previous ‘lessons’ to each exercise. Success depends much on agility, accelerated by both automation and rapid mobilization. This way, it can meet the risk requirements defined in agreement with the organizational or business priorities defined from the beginning in collaboration with executives. 

Three Reasons Cymulate is your Continuous Threat Exposure Management Partner of Choice: 

1. Multifunctional validation platform 

Rolling the CTEM program out cannot depend solely on technology, but a platform that consolidates the different functions necessary for security posture assessment and optimization is a key component that simplifies the process and helps operationalize the program.  

For instance, Cymulate brings together external attack surface management (EASM), automated red teaming, vulnerability prioritization, and breach and attack simulation capabilities. 

2. Test and evaluate processes 

Assessing security technologies is insufficient. We started by stating that CTEM isn’t a tool. Its success depends on the collaboration between teams and workflows between them. Part of the evaluation of the security strategy focus on processes. Responsibilities, handoffs, information flows, awareness, response, priorities, and so on. Therefore, testing the SOAR playbooks, SOC, and incident response validation (internal or managed) via table-top exercises and simulated attacks are necessary to reflect how resilient an organization is and set the baseline for the next scoping and discovery cycles. 

3. Translate findings into business implications 

The above combination of validation technologies into one platform facilitates the collection of extensive information. Security teams, however, have no time to really get into the details of each event or finding. Therefore, they need some guidance for the mobilization phase to translate that information into scores reflecting the potential business impact or risk level. Gartner’s CTEM  program underlines that there is no game without executive leadership requiring straightforward reports, performance improvement over time, drift control, and good scores overall. 

—–

Better and faster decision-making is at the heart of a successful Continuous Threat Exposure Management program and its ultimate KPI. If security posture is tested in advance, preemptive measures are taken, risks remain low, and adversaries are likely to move on to the next target. 

Cymulate provides the most comprehensive validation technology available and gives organizations the necessary clarity. 

Practically, here is some more detailed guidance and considerations before gearing into CTEM.