This is the Exposure Brief, a monthly note from CTEE about running a continuous threat exposure management program: what changed in the market, and one thing worth doing about it. It arrives once a month and nothing else lands in your inbox from us in between.
The one thing
Start measuring your validation rate.
Validation rate is the share of the exposures you prioritised this cycle that were tested rather than accepted on severity. You do not need a new tool to produce it. Take the exposures you ranked as must-fix this month, count how many of them somebody actually proved exploitable in your environment, whether by a penetration test, a simulation run or an engineer with a terminal, and report that as a fraction.
The first number will be embarrassing. Gartner's March 2025 market guide on adversarial exposure validation estimates that 40 percent of organisations will have formal validation initiatives by 2027, which implies most do not have one yet. Publish it anyway, because it is the number that tells your leadership whether the rest of your reporting is built on evidence or on a scanner's opinion.
More on this: The five metrics leadership will read
What moved
Qualys shipped native exploit validation (March 2026)
Agent Val, powered by TruConfirm, reached general availability inside Qualys Enterprise TruRisk Management. The release says it safely tests exploitability in the live environment and reports whether an exploit path is open, blocked by controls or unreachable, and it cites support for more than 1,600 vulnerabilities. It is described as included as part of Qualys ETM, so check what your quote covers. Our directory scores Qualys 2 on validation and 1 on scoping, from public documentation, so scoping is the gap to plan for if you cannot get a second product through procurement.
Picus launched an autonomous exposure validation platform (July 2026)
The platform converges breach and attack simulation, autonomous penetration testing that executes real exploit chains against reachable assets, and an exposure validation module that tests whether a given CVE is exploitable against your controls. If you shortlisted Picus as a simulation tool, the comparison set now includes automated penetration testing; ask which modules are in the quote.
CrowdStrike agreed to acquire XM Cyber's intellectual property (July 2026)
The deal covers more than 45 patents and the source code, with close expected in the second half of CrowdStrike's fiscal 2027. CrowdStrike acquires the IP only, not XM Cyber's revenue or customers, and XM Cyber continues as a standalone business with an IP licence from CrowdStrike. If you are looking at either product, get in writing how long that standalone arrangement lasts, because attack path analysis is the strongest thing XM Cyber sells and the release gives no term for it.
We have not tested any of these products. All of the above comes from vendor and public material, and every directory entry says so.
From the site
Vendor directory
Seventeen platforms scored by stage coverage, with the gaps stated rather than glossed. Every entry was re-audited against vendor documentation on 20 September 2026.
How to evaluate CTEM vendors
The questions to ask per stage, and the red flags that mean rebranded scanning.