COMMENTARY: Vulnerability management (VM) has become much better at deciding which vulnerabilities deserve attention. We don’t just look at severity anymore as the only factor. Exploit activity, asset importance, and other risk information can all affect the queue.
Continuous threat exposure management (CTEM) takes on a bigger job: it covers more than vulnerabilities and follows exposures further, including whether attackers can exploit them, who needs to fix them, and whether the fix worked.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
The difference becomes obvious at remediation. A security team can have excellent visibility across its attack surface and still rely on analysts to create tickets manually, find asset owners, and chase outstanding work.
Where does vulnerability management stop and CTEM begin?
VM revolves around software vulnerabilities. Teams find them, assess their risk, and get them patched or otherwise remediated.
Risk-based prioritization has changed how those findings are handled. CTEM brings other types of exposure into the same program. Misconfigurations, insecure credentials, identity weaknesses, and risky relationships between systems can matter just as much as a software flaw.
Exposure management involves the broader practice of finding and reducing those exposures across the attack surface. So, where does CTEM fit in? Gartner introduced the framework in 2022 and divided it into five stages: scoping, discovery, prioritization, validation, and mobilization.
CTEM runs as a continuous loop, with teams rescoping as the environment changes and returning to exposures after remediation to see what remains.
Validation helps determine whether an exposure deserves the priority it has been given. A vulnerability can rank highly and still have limited value to an attacker in that particular environment. Testing may reveal an attack path to a critical asset.
Mobilization gets the work to the team that owns the affected system, application, or identity. Once remediation takes place, the exposure needs a recheck before it leaves the program.
Here’s why point solutions often leave remediation behind
Point solutions can identify and prioritize exposures without offering a direct route into the workflows used to fix them.
A vulnerability scanner finds software flaws. Other products may identify cloud configuration problems, internet-facing assets, or identity exposures.
The person who can fix an exposure may spend the day in a ticketing system, a patch management console, or another operational tool. Without a useful connection between those systems, an analyst has to create the work, find the owner, and keep track of it afterward.
Suppose validation shows that an exposure creates an exploitable route to a critical system. A ticket containing only the affected asset and vulnerability details gives the receiving team little indication of why it moved to the front of the queue.
Adding more discovery products does not fix the handoff. The team may end up with a more complete inventory of its exposures while the route from finding to remediation stays largely manual.
What does a unified exposure management platform close?
A unified exposure management platform promises to connect discovery and validation with the remediation workflows used to get the work done.
Remediation already happens in different places for good reasons. Developers have their workflows, while IT teams may work somewhere else. An identity problem will not get fixed in the same way as a vulnerable server.
When discovery, validation, and remediation workflows are connected, the finding can reach the people responsible for fixing it with the exposure context attached. Security can see who owns the work and its status, then check the exposure again after changes are made.
Security also needs a way to follow the work without maintaining another record by hand.
Five signs a program still runs as VM, not CTEM
A VM program can use sophisticated risk scoring and continuous scanning without becoming CTEM. Look at the scope of the program and what happens after a vulnerability gets discovered. Here are the signs:
- Everything begins with the scanner: CTEM starts by deciding what the organization needs to protect.
- The unit of work still revolves around the individual vulnerability: That works for VM. CTEM also needs to understand how exposures connect and what those connections could give an attacker access to.
- Prioritization gets treated as enough evidence to remediate: A high ranking tells the team where to look first.
- Security handles the handoff by hand: Analysts still have to create tickets, find owners, and track remediation manually.
- Ticket closure ends the process: The work gets marked complete without checking whether the exposure remains.
Why does remediation matter more than raw coverage?
Because an exposure that’s found but not fixed is still an exposure.
Coverage remains straightforward to compare during an evaluation. A buyer can see which environments a platform supports and which types of exposure it finds. The remediation side takes more digging.
Take a validated exposure and look at what happens after security decides somebody needs to fix it. The real test: whether validated exposures move efficiently from identification to remediation and verification, so risk actually gets reduced rather than simply documented.
David Balaban, owner, Privacy-PC
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
