CTEM · CONTINUOUS THREAT EXPOSURE MANAGEMENT
Continuous Threat Exposure Management, defined by Gartner, organizes threat exposure management into five continuous phases. CSURFACE operationalizes this cycle on the external attack surface with its own architecture: machine learning models for discovery and classification, proprietary agentic layer for decision-making before alerting, active exploitation prioritization, and exploitability validation — all under a single data model.
WHAT HAS CHANGED
Not every vulnerability is a real exposure, and not every exposure carries the same impact.
Traditional vulnerability management lists CVEs and prioritizes by a static score. CTEM takes a different approach and focuses on what is actually exploitable and critical to the business.
That's why CTEM operates as a continuous cycle. The five phases — Scoping, Discovery, Prioritization, Validation, and Mobilization — work continuously because the attack surface and threat landscape change every week. Each phase feeds into the next.
THE PROBLEM
The CTEM program addresses a recurring set of issues. CSURFACE was designed around them — and the matrix ahead shows the level of coverage in each phase.
Inherited subdomains, forgotten environments, subsidiaries, and the digital supply chain compose a surface that exceeds official inventory. Machine Learning-driven discovery incorporates these assets into scope before any prioritization.
Scanners produce lists that grow faster than remediation capacity. Prioritization by active exploitation and asset criticality defines the order of treatment and contains operational noise.
CVSS measures theoretical severity, not the real exposure of the environment. Prioritization crosses observed exploitability — threat indicators and active exploitation — with the criticality of each discovered asset.
The presence of a vulnerable version does not always represent an actionable attack path. Validation confirms exploitability where there is test coverage, separating what requires response from mere version matching.
Leaked corporate credentials and the external posture of third parties (Vendor Risk) expand the surface without appearing in vulnerability scanners. CSURFACE monitors both within the same cycle as part of prioritized exposure.
Technical results rarely support board-level decision-making. Financial quantification by FAIR methodology translates prioritized exposure into monetary value, with an auditable trail per phase of the cycle.
THE CICLO CTEM
Defined by Gartner, the CTEM operates as a continuous cycle — not a project with a beginning and an end.
Defines what is included in the evaluation: the assets and exposure surface that matter to the business, and the criteria by which exposure will be measured.
Finds the exposures within the scope — assets, vulnerabilities, and configurations — including those not officially inventoried.
Orders the exposures by real risk: what is actually exploitable and critical to the business receives priority over purely theoretical severity.
Confirms whether the exposure is truly exploitable and if the applied fix actually closed the attack path.
Brings the prioritized findings to the responsible team, with context and suggestion for remediation, so that the fix can happen.
COVERAGE
The level of coverage that the platform delivers in each phase — with transparency on where the action is by the platform and where it is collaborative.
| CTEM Phase | Coverage | How CSURFACE delivers |
|---|---|---|
| 1 · ScopingScope definition | Good | Discovery of the external surface and criticality classification by Machine Learning provide the asset base and exposure criteria. The scope is external — we do not analyze the internal network inventory; business alignment is collaborative. |
| 2 · DiscoveryDiscovery | Good | Continuous discovery of the external attack surface — including shadow IT, subsidiaries, and digital supply chain. Does not cover internal network inventory. |
| 3 · PrioritizationPrioritization | Complete | Dynamic prioritization based on real exploitability — threat indicators, threat intelligence, and observed active exploitation — cross-referenced with the criticality of each discovered asset. |
| 4 · ValidationValidation | Good | Where test modules are available, CSURFACE actively confirms exploitability. In other cases, evaluation is passive — version matching. |
| 5 · MobilizationMobilization | Good | CSURFACE sends prioritized alerts with suggested remediation. Evaluation and execution of the fix are done by the customer's team. |
WHAT YOU GET
The five phases under a single data model, with context preserved from one phase to the next.
The remediation queue follows active exploitation observed, continuously updated.
Each phase of the cycle generates auditable trail, and risk reaches the board translated into financial value.
FREQUENTLY ASKED QUESTIONS
CTEM is the evolution of it. Vulnerability management focuses on listing and fixing CVEs; CTEM adds validation ("is it really exploitable?"), dynamic prioritization ("what matters now?") and mobilization ("is it actually being remediated?") — in a continuous cycle.
External Attack Surface Management (EASM) is a component of CTEM — it primarily corresponds to the Discovery phase applied to the external surface. CTEM encompasses all five phases in a complete cycle.
No, when the cycle is supported by a platform. CSURFACE automates discovery, prioritization, and validation; the team focuses on remediation decisions and response.
Gartner does not certify individual products. CSURFACE implements all five phases according to the CTEM framework published by Gartner — the matrix above describes, with transparency, the level of coverage for each phase.
Enter your company domain and receive a preliminary analysis of your external exposure. No card, no meeting required.
Receive preliminary analysis