Directory
CTEM vendors, by the stages they actually cover.
Every vendor below now markets a CTEM story. This directory records which of the five stages each product genuinely serves, in our assessment, so you can assemble a program rather than buy a slogan.
How we assess coverage
- Evidence. Every entry is compiled from public vendor documentation: product docs, release notes and published pricing. Scores are our reading of that documentation.
- Scale. ■ full: the product is a credible primary tool for that stage. ◪ partial: it contributes but you would pair it with something else. □ none: not a meaningful capability today. The per-stage definitions are in How we score each stage below.
- Money. No vendor has paid for an entry or seen a summary before publication. The claimed and sponsored-listing tiers are described on the partner page.
- Cadence. Each entry carries its review month. We re-review on major releases and at least every six months.
- 01 Scoping: Agree what is in play
- 02 Discovery: Find every exposure, not just CVEs
- 03 Prioritisation: Rank by attack path and impact
- 04 Validation: Prove it is exploitable
- 05 Mobilisation: Get it fixed, and show it
Sort
Filter All
■ full · ◪ partial · □ none. Columns 01–05 are the stages in the strip above.
| Product | 01 Scope | 02 Discover | 03 Prioritise | 04 Validate | 05 Mobilise | Our summary |
|---|---|---|---|---|---|---|
| Armis Centrix | Scoping: partial | Discovery: full | Prioritisation: full | Validation: none | Mobilisation: full | Asset-intelligence platform that grew into exposure management, strongest where the estate includes OT, medical devices and unmanaged IoT. Prioritisation and remediation workflow are mature; adversarial validation is not native. Exposure platformAsset intelligenceOT and IoT security |
| CyCognito | Scoping: partial | Discovery: full | Prioritisation: full | Validation: full | Mobilisation: partial | External attack surface management with genuine active testing rather than inference. Discovery and validation of internet-facing assets are strong; there is no internal, identity or endpoint coverage at all. Attack surface managementValidationApplication security |
| Cymulate | Scoping: none | Discovery: partial | Prioritisation: partial | Validation: full | Mobilisation: partial | Breach and attack simulation vendor that repositioned as an exposure management platform in August 2025. Validation is the core and the strongest stage; discovery is lighter than scanner-first platforms. Breach and attack simulationValidationExposure platform |
| Detectify | Scoping: none | Discovery: partial | Prioritisation: partial | Validation: partial | Mobilisation: partial | External attack surface monitoring for web applications, powered by crowdsourced security research. Narrow by design, strong on internet-facing apps, and one of the few vendors publishing at least its platform-tier prices. Attack surface managementApplication security |
| Falcon Exposure Management | Scoping: full | Discovery: full | Prioritisation: full | Validation: partial | Mobilisation: full | Exposure management inside the Falcon platform, most compelling if you already run Falcon sensors, though since June 2026 it is also sold for third-party endpoint environments. Four stages are well covered; adversarial validation is a services offering rather than a product. Exposure platformAttack surface managementEndpoint security |
| Intruder | Scoping: none | Discovery: partial | Prioritisation: partial | Validation: partial | Mobilisation: partial | Lightweight external and internal scanning for small and mid-size teams, with published prices and a free tier. A realistic entry point to exposure management without an enterprise budget. Attack surface managementVulnerability management |
| IONIX | Scoping: partial | Discovery: full | Prioritisation: full | Validation: full | Mobilisation: partial | External exposure management that follows the digital supply chain into vendor-managed and third-party dependencies, with safe exploit simulation to confirm what is really exploitable. Attack surface managementValidationThird-party risk |
| Microsoft Security Exposure Management | Scoping: full | Discovery: full | Prioritisation: full | Validation: partial | Mobilisation: partial | Exposure management built into the Defender portal, drawing on whatever Microsoft security products you already license. Strong scoping and attack paths; no native adversarial validation. Exposure platformAttack path analysis |
| Nucleus Security | Scoping: partial | Discovery: partial | Prioritisation: full | Validation: none | Mobilisation: full | Aggregation and remediation layer over the scanners you already run. Prioritisation and mobilisation are among the strongest in this directory; it does no scanning or testing of its own, and discovery is limited to the inventory and intelligence-led detection it derives from connected tools. Exposure platformVulnerability managementRemediation orchestration |
| Orca Security | Scoping: partial | Discovery: full | Prioritisation: full | Validation: partial | Mobilisation: full | Agentless cloud security platform with strong attack path analysis and agentic remediation. Cloud only, and it markets exposure management less explicitly than its competitors. Cloud securityExposure platformAttack path analysis |
| Pentera | Scoping: none | Discovery: partial | Prioritisation: full | Validation: full | Mobilisation: full | Automated, safe-by-design penetration testing across internal, external and credential exposure. Among the deepest validation in this directory, and now with real remediation workflow too. Automated penetration testingValidationRemediation orchestration |
| Picus Security | Scoping: none | Discovery: partial | Prioritisation: partial | Validation: full | Mobilisation: partial | Security validation platform that tests controls against current attack techniques and maps the results to exposure. Among the strongest options for proving whether detection and prevention actually work. Breach and attack simulationValidationDetection engineering |
| Qualys Enterprise TruRisk | Scoping: partial | Discovery: full | Prioritisation: full | Validation: full | Mobilisation: full | Long-standing scanning platform that added native exploit validation in 2026, making it one of the few vendors that touches all five stages without a second product, though scoping is only partial. Exposure platformVulnerability managementValidation |
| Rapid7 Exposure Command | Scoping: partial | Discovery: full | Prioritisation: full | Validation: partial | Mobilisation: full | Combines vulnerability management, external attack surface and cloud posture into one hybrid exposure view. Broad coverage for mixed estates; validation is a managed service rather than a product feature. Exposure platformVulnerability managementCloud security |
| Tenable One | Scoping: partial | Discovery: full | Prioritisation: full | Validation: partial | Mobilisation: full | One of the broadest discovery footprints in the directory, built on Tenable's scanning heritage and extended by the Vulcan Cyber acquisition. Validation is limited to security control status, not adversarial testing. Exposure platformVulnerability managementAttack path analysis |
| Wiz | Scoping: partial | Discovery: full | Prioritisation: full | Validation: full | Mobilisation: full | Cloud security platform that extended convincingly into exposure management, with an outside-in attack surface module and an autonomous penetration testing agent. Cloud-first, now part of Google Cloud. Cloud securityExposure platformValidation |
| XM Cyber | Scoping: partial | Discovery: full | Prioritisation: full | Validation: partial | Mobilisation: full | One of the most established attack path analysis products: a digital twin of the environment that ranks choke points by how many paths to critical assets they cut. CrowdStrike agreed to buy its intellectual property in July 2026. Attack path analysisExposure platformValidation |
Sponsored listings are paid placements shown in a separate labelled block above the table. Payment never changes order in the table, scores or our summaries.
How we score each stage
| Stage | ■ 2 full | ◪ 1 partial | □ 0 none |
|---|---|---|---|
| 01 Scoping | Helps agree what is in scope and its business criticality, with a criticality model in the product. | Contributes scope or asset context, but agreeing scope and criticality is left to you or to another tool. | No scoping capability: "you configure that yourself" and no criticality model. |
| 02 Discovery | Collects several sources natively, beyond CVEs (misconfigurations, credentials, identity, internet-facing assets). | Narrow (for example external only) or mostly ingests sources from other products through integrations. | No discovery capability. |
| 03 Prioritisation | Ranks by attack path, reachability and business impact. | Adds context such as exploitation intelligence or asset criticality, but no attack-path reasoning. | Severity score (CVSS) and asset count only. |
| 04 Validation | Native active testing that attempts the exploit or attack and records proof of the result. | Modelled, inferred or on-demand: exploitability is inferred from a feed or a model, or testing runs only when requested. | No validation capability. |
| 05 Mobilisation | Assigns a fix owner and a date, and re-tests before the ticket closes. | Tickets, owners or workflow, but "closed" only means the ticket status changed; no re-test. | No mobilisation capability. |
How to read this
- Exposure platform: aims at discovery and prioritisation across multiple sources. Usually the system of record.
- Attack path analysis: models how exposures chain to critical assets. Prioritisation specialists.
- Breach and attack simulation, automated penetration testing: validation. Prove the exposure is real and the controls miss it.
- Attack surface management: external discovery. Fast to deploy, narrow by design.
Head-to-head comparisons
Missing or wrong? Vendors and users can send corrections. We publish corrections, not press releases.
List your productClaim a listingDirectory as JSONStage Coverage Matrix as open data