Self-assessment

Score your exposure program.

By Dan Swihart · Published

This CTEM maturity assessment covers 20 statements, about ten minutes. Rate how true each one is for your organisation today. You get a score per stage, an overall maturity level, and the three actions that would move you furthest.

Nothing is sent anywhere until you choose to save your results at the end. Want the two-minute version first? Take the quick check.

  1. 01 Scoping: Agree what is in play
  2. 02 Discovery: Find every exposure, not just CVEs
  3. 03 Prioritisation: Rank by attack path and impact
  4. 04 Validation: Prove it is exploitable
  5. 05 Mobilisation: Get it fixed, and show it

0 of 20 answered

01 Scoping 0 of 4

01.1We have a written definition of which assets and business processes are in scope for exposure management.
01.2Business owners, not only security, agreed on what counts as a critical asset.
01.3Scope is reviewed and adjusted on a defined cadence, at least quarterly.
01.4External attack surface, SaaS and identity are explicitly included or excluded, not left undefined.

02 Discovery 0 of 4

02.1We maintain an asset inventory that reconciles multiple sources (scanner, cloud, EDR, CMDB) and flags unknowns.
02.2Discovery covers misconfigurations, exposed credentials and identity weaknesses, not only CVEs.
02.3Internet-facing assets are enumerated continuously, including forgotten subdomains and shadow IT.
02.4Third-party and supplier access paths into our environment are discovered and recorded.

03 Prioritisation 0 of 4

03.1Exposures are ranked by exploitability in our environment and business impact, not by raw severity score.
03.2We use attack-path analysis or equivalent reasoning to see how exposures chain to critical assets.
03.3Threat intelligence on active exploitation (for example CISA KEV) feeds prioritisation automatically.
03.4Existing compensating controls are considered before an exposure is escalated.

04 Validation 0 of 4

04.1Top-priority exposures are validated as actually exploitable before remediation effort is committed.
04.2We test whether detection and response controls fire when an exposure is exercised.
04.3Validation uses tooling (breach and attack simulation, automated pentesting) rather than only annual manual tests.
04.4Validation results change priorities: unexploitable findings are downgraded and documented.

05 Mobilisation 0 of 4

05.1Every prioritised exposure has a named owner outside the security team and a target date.
05.2Remediation is tracked to closure with time-to-fix measured per exposure class.
05.3Findings reach remediation teams through their own workflow tools, not spreadsheets or email.
05.4Progress is reported to leadership in business terms (risk reduced, processes protected), not counts of vulnerabilities.