Independent · Sponsors labelled · Exposure management

Most CTEM programs cannot name the ten things that matter this month.

CTEE is a field guide to Continuous Threat Exposure Management: what the five stages actually require, which tools cover which stage, and how mature your own program is. Written by a practitioner. No vendor pays for coverage or scores.

The independent CTEM reference: explainer, self-assessment, and vendor scoring.

Take the 2-minute quick checkScore your full program

New to this? Read CTEM vs vulnerability management.

  1. Internet-facing host
  2. Stale credential
  3. Over-privileged role
  4. Unpatched service
  5. Critical asset
  1. 01 Scoping: Agree what is in play
  2. 02 Discovery: Find every exposure, not just CVEs
  3. 03 Prioritisation: Rank by attack path and impact
  4. 04 Validation: Prove it is exploitable
  5. 05 Mobilisation: Get it fixed, and show it

Contents

  1. Guide

    The five stages, without the jargon

    What each stage demands, where programs stall, and how CTEM differs from the vulnerability management you already run.

  2. Quick check

    Which stage is your weakest?

    Five questions, two minutes, nothing stored. The fast way to know where to look first.

  3. Assess

    Score your program

    Twenty statements. A score per stage, a maturity level, and the three moves that would take you furthest. Save it and re-take next quarter.

  4. Vendors

    Vendors, by what they actually cover

    Every platform now sells a CTEM story. The directory shows which of the five stages each product genuinely serves.

  5. Latest

    CTEM prioritisation without CVSS: using KEV, EPSS and business context

    Put CISA KEV first, rank the rest by EPSS, use CVSS for impact. A worked example, vendor questions and thresholds you can defend.

Get the monthly Exposure Brief

One email a month: what changed in exposure management, which vendors moved, and one thing worth doing. No spam, unsubscribe any time.

See a sample issue

We'll email a confirmation link. Click it once. The email comes from newsletter@ctee.org.

Your email is used only to send the newsletter, after you confirm it. Details: Privacy notice.