CTEM prioritisation without CVSS: using KEV, EPSS and business context
Put CISA KEV first, rank the rest by EPSS, use CVSS for impact. A worked example, vendor questions and thresholds you can defend.
Blog
Blog
Practical notes on running the exposure cycle.
All posts
How to run a CTEM maturity self-assessment in an afternoon
Run a CTEM maturity self-assessment: who to invite, how to answer honestly, how the score is calculated and what each level means.
State of CTEM vendor coverage, Q3 2026: what 17 vendors actually cover
Stage-by-stage counts from the CTEE Stage Coverage Matrix: 17 vendors scored 0, 1 or 2 on the five CTEM stages. Scoping is the widest gap.
Breach and attack simulation vs CTEM: where they overlap
BAS tests whether controls catch known techniques; CTEM validation proves an exposure is exploitable. Where they overlap and why BAS is an input.
How to evaluate CTEM vendors: a buyer's checklist
The questions to ask each vendor per stage, the red flags that mean rebranded scanning, and how to avoid buying five tools that don't talk.
Explaining CTEM to a board that has never heard of it
How to explain CTEM to a board in a 10-15 minute slot: business language, two analogies, what to leave out and how to show progress honestly.
A CTEM maturity model you can actually use
Five levels from Initial to Optimising, what each looks like across the five CTEM stages, and the evidence that proves you are there.
The only CTEM metrics leadership will read
Five exposure management KPIs that survive a board meeting, why vulnerability counts fail, and how to put them on one page.
CTEM tools: what each category actually does
Exposure platforms, attack path analysis, BAS, automated pentesting and EASM, mapped to the five CTEM stages so you buy for the gap you have.
Exposure management vs attack surface management
EASM, CAASM and exposure management overlap on discovery and part ways after it. Here is where each one ends and which you actually need.
How to start a CTEM program in 90 days
A week-by-week plan for a first CTEM cycle: one narrow scope, the people to involve, the first metrics, and the ways it usually fails.
CTEM vs vulnerability management: what actually changes
Renaming your scanner does not make a CTEM program. Here is the concrete difference in what you measure, how you rank it, and who fixes it.