Why scanning more doesn't help
Most security teams already have more findings than they can fix. Adding another scanner adds rows, not decisions. Continuous Threat Exposure Management (CTEM), a framework Gartner described in 2022, reframes the work as a recurring cycle whose output is fixed exposures, not reports.
CTEM is a program, not a product. Tools help with parts of it, but the cycle only works when security and the teams that own systems agree on what gets fixed and by when.
The five stages
- Scoping: pick a business-relevant slice, such as the external attack surface, one critical application or SaaS identity. Not everything at once.
- Discovery: find the assets and exposures in that scope: vulnerabilities, misconfigurations, exposed credentials, risky identities and unmanaged assets.
- Prioritization: rank by exploitability and business impact, not severity score alone. Useful inputs are reachability, known exploitation (for example CISA's Known Exploited Vulnerabilities catalog), EPSS probability and what the asset leads to.
- Validation: prove whether an attack path actually works, with attack path analysis, breach and attack simulation or manual testing, and confirm your controls detect it.
- Mobilization: get the fix done. Named owners, tickets in the owning team's tracker, agreed timelines, and exceptions that expire.
Where programs stall
- Mobilization: security finds, other teams fix. Without named owners and agreed timelines, exposures simply age.
- Scope creep: the first cycle tries to cover every asset and never finishes.
- Severity-only ranking: a critical score on an unreachable host outranks a medium on an internet-facing login page.
- No validation: teams argue about theoretical risk instead of looking at evidence that a path works.
A first 90 days
- Weeks 1–2: choose one scope and name the system owners in it.
- Weeks 3–6: merge discovery sources into one asset and exposure inventory, and deduplicate.
- Weeks 7–10: rank with exploitability signals and validate the top items.
- Weeks 11–13: agree fix timelines, track closure, review what worked and pick the next scope.
What to measure
Measure outcomes, not volume. Track the time from discovery to verified fix for validated exposures, the share of attack paths to critical assets that are closed, and the number of exceptions past their expiry date. A rising count of findings discovered tells you about your scanners, not your risk.