Blog
CTEM tools: what each category actually does
Every vendor with a scanner, an agent or an attack graph now sells “CTEM”. The word is on the box; the stage coverage is not. This guide is about categories rather than products: what each class of tool does, which of the five stages it serves, and where it stops. The vendor directory records our stage-by-stage assessment of individual products. Every entry is compiled from public vendor documentation; none of it is hands-on testing.
The five stages, briefly
Gartner’s CTEM model has five stages: scoping, discovery, prioritisation, validation and mobilisation. If you need the full explanation, read What is CTEM first. For this post, the short version: agree what is in play, find every exposure in it, rank by attack path and impact, prove the top ones are exploitable, and get them fixed by someone with a name.
No category below covers all five. Most cover two well and touch a third. That is not a criticism; it is how the market is shaped, and it is why “CTEM tool” is a misleading search term.
Exposure assessment platforms
This is the category that most often calls itself a CTEM platform. Gartner named it “exposure assessment platforms” and published its first Magic Quadrant for the category in 2025 (Gartner; see also Tenable’s announcement of its placement). Most entrants grew out of vulnerability scanning: Tenable, Qualys and Rapid7 are the obvious examples, with CrowdStrike arriving from the endpoint side.
What they do: aggregate findings from scanners, cloud posture tools, identity systems and sometimes external scans into one inventory, then score each finding on something richer than CVSS. Typical inputs are exploit availability, active exploitation from sources such as the CISA KEV catalogue, EPSS probability, asset criticality and, in the better products, whether the asset sits on a path to something important.
Stages served: discovery and prioritisation, strongly. Scoping is usually supported through tagging and asset groups rather than anything that helps you agree scope with the business. Mobilisation is ticketing integration and dashboards. Validation is almost always absent or delivered by a partner; the platforms tell you an exposure is probably exploitable, they do not prove it.
Where they stop: at the reach of their integrations. If a source is not connected, the platform does not know it exists. Budget for the integration work.
Attack path analysis
Attack path tools build a graph of your environment: hosts, identities, permissions, trust relationships, network reachability. Then they compute how an attacker who lands on one node could reach another. The output is not “here are 4,000 criticals” but “these twelve exposures sit on most of the paths to the domain controllers.” XM Cyber is the specialist; several exposure platforms now bundle a lighter version.
Stages served: prioritisation, with a strong claim to be the best tool for it. Discovery is partial, because the graph is only as complete as the identity and network data fed into it. Validation is partial: the path is modelled, not exercised.
Where they stop: the model can be wrong. A path that exists in the graph may be blocked by a control the tool cannot see. That is exactly why validation is a separate stage.
Breach and attack simulation
BAS tools run known attacker techniques, usually mapped to MITRE ATT&CK, against your environment in a controlled way, and record whether your controls prevented, detected or missed each one. Cymulate and Picus are the long-standing names.
Stages served: validation, specifically validation of controls. BAS answers “would our EDR catch this technique?” rather than “is this specific host exploitable?” Mobilisation is partial: the better products produce detection rules and configuration changes rather than a red cell in a grid. Discovery and scoping are not what they are for.
Where they stop: BAS tests what it is told to test. It does not find the forgotten VPN appliance, and it does not tell you which of your exposures matter most unless it is fed a prioritised list from elsewhere.
Automated penetration testing
Automated pentesting tools start from a foothold, or from the outside, and attempt to actually exploit what they find, chain it, harvest credentials and move laterally, with safety rails. Pentera is the reference example. Gartner’s March 2025 Market Guide for Adversarial Exposure Validation folded BAS, automated pentesting and automated red teaming into a single category it calls AEV, described as technologies that deliver consistent, continuous and automated evidence of the feasibility of an attack.
Stages served: validation, of exposures rather than controls. This is the tool class that turns “CVSS 9.8” into “yes, we got a shell and read the backup credentials” or “no, the exploit fails behind the WAF.” Discovery is a side effect: it finds things on the way. Prioritisation is partial; a validated path is a strong signal but the tool does not know your business impact.
Where they stop: coverage. Automated pentesting runs where you point it. It also cannot test what would be unsafe to test in production, which means some of your most important systems will still need a manual tester.
External attack surface management
EASM tools look at your organisation from the internet, without credentials, the way an attacker would during reconnaissance. They enumerate domains, subdomains, certificates, exposed services, cloud storage, leaked credentials and third-party pages carrying your brand. Detectify and Intruder are examples in the directory; every large exposure platform now includes an EASM module.
Stages served: discovery, for the external slice of scope. Prioritisation is partial, usually severity of the exposed service plus whether it was previously unknown to you. Nothing on validation or mobilisation beyond alerts and tickets.
Where they stop: at the perimeter, by design. An unauthenticated, internet-facing scan cannot see identity and configuration problems that sit inside the network; closing that gap needs credentials and internal access, which is a different tool category. We cover the distinction in more depth in Exposure management vs attack surface management.
Where identity and cloud posture tools fit
Two categories are not CTEM tools but feed CTEM directly.
Identity security posture tools (Active Directory hygiene, ITDR, entitlement analysis) find the over-privileged service accounts, stale admin rights and Kerberos misconfigurations that make up most real attack paths. They are a discovery source, and a prerequisite for useful attack path analysis. Without identity data, the graph is missing its most important edges.
Cloud security posture management does the same job for cloud configuration: public buckets, permissive security groups, unrotated keys, exposed control planes. Again, a discovery source. Most exposure platforms ingest CSPM findings; some CNAPP vendors now market their own exposure story.
Neither category validates or mobilises. Treat them as inputs, and check that whichever platform you choose can ingest them without a services engagement.
Category to stage, in one table
| Category | Scoping | Discovery | Prioritisation | Validation | Mobilisation |
|---|---|---|---|---|---|
| Exposure assessment platform | partial | full | full | none, or via partner | partial |
| Attack path analysis | partial | partial | full | partial | partial |
| Breach and attack simulation | none | none | partial | full (controls) | partial |
| Automated penetration testing | none | partial | partial | full (exposures) | partial |
| External attack surface management | none | full (external only) | partial | none | none |
| Identity and cloud posture | none | full (their slice) | partial | none | none |
The table is a generalisation about categories. Individual products vary, and the directory records the product-level view with a review date on each entry.
What this means when you are buying
Two patterns work. The first is platform plus validation: an exposure assessment platform for discovery and prioritisation, an AEV tool for validation, and your existing ticketing system for mobilisation. The second is best-of-breed: EASM, identity posture and CSPM as discovery sources, attack path analysis for prioritisation, automated pentesting for validation, and a lot of integration work to hold it together.
Neither pattern buys you scoping. That stage is a conversation with business owners, and no tool will have it for you. Neither pattern buys you mobilisation either, beyond the plumbing. If your remediation teams do not accept tickets with a named owner and a date, the best-integrated stack will produce a beautifully prioritised list that nobody fixes.
Buy for the stage you are weakest in. If you do not know which that is, the quick check will tell you in two minutes.
Next
Read Exposure management vs attack surface management if the EASM and CAASM overlap is still unclear, then take the full assessment before you take a vendor call. The directory is there when you know which gap you are filling. Before you shortlist, run candidates through the vendor evaluation checklist.