Start here

The shortest path through exposure management.

If you have been told to "stand up a CTEM program" and are not sure what that means in practice, read these in order. About twenty minutes end to end, split between the explainer and the assessment.

I run the program

You own or are standing up the CTEM cycle and need a plan, a baseline and a first 90 days.

How to start in 90 days

I am choosing a tool

You are shortlisting products and want stage coverage from one published rubric, not a pitch.

Browse the vendor directory

I have to explain it to the board

You need a plain-language case and a one-page set of numbers that leadership will actually read.

Explaining CTEM to the board

Get the monthly Exposure Brief

One email a month: what changed in exposure management, which vendors moved, and one thing worth doing. No spam, unsubscribe any time.

See a sample issue

We'll email a confirmation link. Click it once. The email comes from newsletter@ctee.org.

Your email is used only to send the newsletter, after you confirm it. Details: Privacy notice.

  1. 01 Scoping: Agree what is in play
  2. 02 Discovery: Find every exposure, not just CVEs
  3. 03 Prioritisation: Rank by attack path and impact
  4. 04 Validation: Prove it is exploitable
  5. 05 Mobilisation: Get it fixed, and show it
  1. STEP 1 · 10 MIN

    Understand the five stages

    What CTEM is, where the term comes from, how it differs from the vulnerability management you already run, and what it is not.

  2. STEP 2 · 2 MIN

    Take the quick check

    Five questions, one per stage, answered in your head. Tells you which stage is your weakest before you invest ten minutes in the full assessment.

  3. STEP 3 · 10 MIN

    Score your program

    Twenty statements across the five stages. A score per stage, a maturity level, and the three moves that would take you furthest. Save it and re-take next quarter.

  4. STEP 4 · AS NEEDED

    Fill the gaps with the right tools

    The directory shows which products genuinely cover which stage. Go to it with your weakest stage in mind, not a vendor's pitch.

  5. STEP 5 · MONTHLY

    Keep the cycle running

    Practical notes on the blog and one email a month with what changed, which vendors moved, and one thing worth doing.

Or start from your role

Not sure where to begin? Pick the closest fit and go straight to the matching pieces.