Continuous Threat Exposure Management (CTEM)

Frequently asked questions

What is continuous threat exposure management (CTEM)?

Continuous threat exposure management (CTEM) is a programme described by Gartner in which organisations continuously map, assess and reduce their attack surface instead of checking security once a year. Its focus is not the individual vulnerability but the exposure: everything an attacker can actually reach and exploit from outside or inside. CTEM shortens the time between an exposure appearing and being fixed, because that window decides whether an attacker gets in.

What are the five phases of CTEM?

Gartner describes CTEM as a cycle of five phases. Scoping defines the scope: external systems, cloud, internal infrastructure and the supply chain. Discovery finds vulnerabilities, misconfigurations, leaked credentials and data leaks within it. Prioritisation uses EPSS, CISA KEV and exploit availability to filter out the exposures that need immediate attention. Validation confirms them technically and removes false positives. Mobilisation turns findings into tasks for the responsible teams and tracks them until the fix is confirmed.

What is the difference between CTEM and vulnerability management?

Vulnerability management focuses on known vulnerabilities in known systems. CTEM widens the view to the whole exposure: unknown assets and shadow IT, cloud misconfigurations, leaked credentials and the supply chain. Vulnerability management is therefore one building block inside the CTEM cycle, mainly in the discovery and mobilisation phases. In blacklens.io, external, internal and cloud findings come together in one workflow with the same severities and statuses.

Do we need our own security team to run CTEM?

No, but you need clear ownership. Many blacklens.io customers run the cycle with two or three people in IT because the platform takes care of detection, prioritisation and explanation. Explainable AI describes the root cause, impact and remediation of every finding, and the AI remediation plan groups open findings by shared root cause. The AI runs as a self-hosted LLM in Europe. For the validation phase, certified pentesters can be added via PTaaS.

How quickly does blacklens.io deliver first results?

External discovery starts as soon as you register your domains; first results are usually available within 24 hours. Cloud connectors for AWS, Microsoft Azure, Microsoft 365, Google Cloud, Cloudflare and Hetzner and the Sentry scanner extend the scope over the following days. Sentry runs as a VM or Docker container in your network segments, so no agents on endpoints are needed.

Does CTEM replace the annual penetration test?

No. CTEM makes sure no unnoticed gaps appear between two tests and makes the test itself more targeted. In blacklens.io, the Threat Center verifies exposure automatically with targeted verification scans. Manual tests via PTaaS flow into the same workflow: pentesters mark findings as Verified, attach evidence and repeat tests on the cadence you choose, from weekly to yearly, including retest and pentest report.

How does CTEM support NIS2 and ISO 27001?

Both frameworks require ongoing vulnerability and risk management with traceable documentation. The CTEM cycle produces exactly this evidence: inventory, findings, prioritisation, remediation and retest, with an activity log and scheduled reports. Executive, vulnerability and pentest reports can be sent automatically by email daily, weekly or monthly.

How is exposure measured in blacklens.io?

Through the exposure score from 0 to 100, calculated nightly from assets, exposed services and open findings. The trend over week, month, quarter and year shows whether measures work and serves as a KPI for the management review. Nightly statistics snapshots also record how assets, services and findings develop.