The five stages of CTEM

  1. Scoping. Decide which parts of the business and attack surface matter most, for example the external attack surface, SaaS estate or a critical service.
  2. Discovery. Find the assets in scope and their exposures: vulnerabilities, misconfigurations, leaked credentials and weak controls.
  3. Prioritisation. Rank exposures by how exploitable they are, whether they are being exploited in the wild, and what an attacker would reach.
  4. Validation. Confirm that an attack path really works and that existing controls would or would not stop it, through testing, breach simulation or manual verification.
  5. Mobilisation. Agree remediation with the teams that own the assets, track it, and confirm the fix.

Why CTEM matters

Traditional vulnerability management produces long lists sorted by severity score. Teams cannot fix everything, and high scores do not always mean high risk. CTEM shifts the question from how many vulnerabilities exist to which exposures an attacker could realistically use against what matters most, and whether fixing them actually worked.

CTEM vs vulnerability management

  • Scope. Vulnerability management covers software flaws on known assets. CTEM covers any exposure, including unknown assets, identity weaknesses and leaked data.
  • Prioritisation. Vulnerability management often ranks by CVSS. CTEM ranks by exploitability, business context and validated attack paths.
  • Cadence. Both are ongoing, but CTEM runs in deliberate cycles tied to business priorities.

How DarkInvader helps

DarkInvader supports the discovery, prioritisation and mobilisation stages for the external attack surface. It finds assets and exposures continuously, groups related findings into risks, highlights actively exploited vulnerabilities, and pushes work into ticketing tools through integrations.

Explore Vulnerability Scanning

Frequently asked questions

Is CTEM a product?

No. CTEM is a programme or framework. Organisations put it into practice with a mix of tools such as EASM, vulnerability scanning, breach and attack simulation and ticketing, plus processes for deciding priorities.

Where should a CTEM programme start?

Most start by scoping the external attack surface, because it is where many attacks begin and it can be measured from the outside without long deployments.

What is the validation stage in CTEM?

Validation checks whether a prioritised exposure can really be exploited and whether security controls would detect or block it. It stops teams spending effort on issues that look serious on paper but are not reachable in practice.

Related terms and reading

Sources