Blog
A CTEM maturity model you can actually use
Maturity models have a bad reputation, mostly earned. The typical one is a five-column grid where every cell says “ad hoc”, “repeatable” or “optimised” and nobody can tell which column they are in. This one is built the other way round: each level is defined by evidence you could show an auditor, not by adjectives.
It uses the same five levels as our self-assessment: Initial, Developing, Defined, Managed and Optimising. The assessment scores you out of 100 and places you in a band. This post is the long-form version of what those bands mean.
The five levels
| Level | In one sentence | Evidence you can point to |
|---|---|---|
| 1. Initial | Scanning happens; exposure work is reactive and scanner-driven. | Scan reports. No scope document. No fix owners outside security. |
| 2. Developing | The pieces exist but do not connect. | A scope draft, a partial inventory, a ranked list that is still mostly CVSS. |
| 3. Defined | A repeatable cycle runs on a schedule with a defined scope. | Scope statement signed by a business owner. Cycle calendar. Tickets with owners. |
| 4. Managed | Priorities are validated and remediation is measured. | Validation results that changed priorities. Median time-to-close by class. |
| 5. Optimising | The cycle is continuous, measured and widening. | Coverage of scope trended over quarters. Routine paths automated. Cycle time falling. |
The band thresholds in the assessment are 0 to 20, 21 to 40, 41 to 60, 61 to 80 and 81 to 100. They are deliberately coarse. What matters is the evidence column, and a program can be Managed in one stage while still Initial in another. That unevenness is normal, and it is the most useful thing the model shows you.
Scoping, level by level
At Initial, scope is whatever the scanner reaches. Ask “what is in scope for exposure management?” and the honest answer is “the hosts with an agent.”
Developing has a written scope, usually drafted by security without business input. It lists systems rather than processes.
Defined is the first real step: a one-page scope statement naming systems, environments and business processes, approved by a business owner, and reviewed on a schedule. External attack surface, SaaS, identity and third-party access are each explicitly in or out, with a reason for each exclusion.
Managed adds a business ranking of critical processes that drives prioritisation, and scope changes are triggered by events (a new integration, an acquisition, a retired system) rather than only by the quarterly review.
Optimising means scope is expressed as attack scenarios or business projects, which is what Gartner’s own description of CTEM asks for (Gartner, October 2023), and each cycle widens scope by a planned increment.
Discovery, level by level
Initial discovery is one scanner and its coverage. Unknown assets stay unknown.
Developing has two or more sources (scanner, cloud provider, EDR, CMDB) but they are not reconciled. The same asset appears three times under three names, and assets seen by only one source are not flagged.
Defined reconciles sources monthly and tracks the count of assets seen by one source but not another. Discovery covers misconfigurations and identity weaknesses, not only CVEs. Internet-facing assets are enumerated continuously.
Managed includes exposed credentials, third-party access paths and SaaS integrations, with an owner recorded for each. The reconciliation gap is trending down and is reported.
Optimising treats discovery coverage as a metric: the share of in-scope assets seen by at least two sources, and the time between an asset appearing and being classified. New discovery sources are onboarded without a services engagement.
Prioritisation, level by level
Initial ranks by CVSS. The remediation list is the scanner’s critical tab.
Developing adds exploit intelligence such as the CISA KEV catalogue or EPSS, applied by hand or by a filter.
Defined ranks by exploitability in context plus business impact. Every finding carries two extra fields: reachable from an attacker position, and critical asset in path. Threat intelligence feeds the ranking automatically. Compensating controls are recorded before a finding is escalated.
Managed uses attack path analysis, or an equivalent manual method for the top items, so the ranked list reflects chains rather than isolated findings. The list is explainable: for any top-ten item, someone can draw the path.
Optimising re-ranks continuously as discovery, validation and control changes land. The number of findings that changed priority because of new evidence is itself tracked.
Validation, level by level
Initial validation is the annual penetration test, which validates whatever the tester happened to look at.
Developing runs occasional targeted tests on findings someone was worried about, without a defined trigger.
Defined validates the top five or ten exposures each cycle with a safe test, and records whether detection controls fired. Unexploitable findings are downgraded and the downgrade is documented.
Managed uses tooling, breach and attack simulation or automated penetration testing, so validation runs on a cadence rather than on the availability of a tester. Gartner groups these tools as adversarial exposure validation in its March 2025 market guide, and its estimate of how few organisations will have a formal validation initiative by 2027 is in the metrics post. At this level, validation results demonstrably change the remediation queue, and control gaps found during validation are tracked as their own class of exposure.
Optimising validates continuously against the current top of the list, and validates the fix as well as the finding: a closed ticket is re-tested before it counts as closed.
Mobilisation, level by level
Initial mobilisation is a spreadsheet emailed to IT. Closure is assumed.
Developing opens tickets, but they lack an owner outside security or a target date, and they are tracked by count.
Defined refuses to open a ticket without a named owner and a date. Findings reach remediation teams through their own workflow tool. Ownerless findings are reported weekly.
Managed measures median time-to-close per exposure class and publishes it monthly. Leadership reporting is in business terms, such as critical processes with no validated attack path, rather than counts of vulnerabilities. The CTEM metrics post covers what that report looks like.
Optimising automates the routine: a validated exposure of a known class on an asset with a known owner creates and routes its own ticket, and the program’s effort goes on the exceptions. Time-to-close is trending down and the trend is presented alongside the reasons.
How to use this without lying to yourself
Score each stage separately and take the lowest as your headline. A program that is Managed in discovery and Initial in validation is an Initial program that is very good at finding things it does not prove. The assessment does this arithmetic for you and highlights the weakest stage.
Insist on the evidence column. “We do attack path analysis” is a claim; a top-ten list where every item has a drawn path is evidence. “We validate” is a claim; a log of last cycle’s downgrades is evidence.
Expect to move one level per two or three cycles, not per quarter. The jump from Developing to Defined is mostly writing things down and getting a signature. The jump from Defined to Managed is the expensive one, because it needs validation tooling and a remediation process that measures itself. Do not skip it; it is the difference between CTEM and vulnerability management with a new name.
Next
Take the quick check to find your weakest stage in two minutes, or the full assessment for a score per stage and a saved scorecard. If you land at Initial or Developing, How to start a CTEM program in 90 days is the practical path to Defined.