The job to be done
Choose which exposure to reduce next, then verify that the risk changed.
Vulnerability management inventories software and configuration weaknesses on known systems, typically with authenticated scans or agents, then tracks remediation. Exposure management asks which conditions could realistically produce a material incident, including unpatched flaws, leaked credentials, over-privileged identities, and internet-facing assets. Continuous Threat Exposure Management (CTEM) is a program for running that cycle, not a product stock-keeping unit. Keep Common Vulnerability Scoring System (CVSS) severity, Exploit Prediction Scoring System (EPSS) likelihood, CISA Known Exploited Vulnerabilities (KEV) evidence, reachability, business impact, and compensating controls as separate signals.
What goes in
- Asset inventory and ownership
- Scanner and configuration findings
- Threat, exploitation, and exposure context
What should come out
- Prioritized remediation work
- Exceptions with owners and expiry
- Evidence of verification and residual risk
Inside the segment
These capabilities answer different questions. Use the distinction to define the work before assembling a shortlist.
Authenticated scanning and agent assessment
Inspect installed packages, missing patches, and local misconfigurations on systems the organization already knows, using credentials or lightweight agents.
Boundary: Unauthenticated probes miss local state. Coverage still fails on unmanaged, operational technology, and air-gapped systems that credentials and agents cannot reach.
External attack surface management
Recursively map internet-indexed hosts, domains, certificates, and cloud edges from known seeds so previously unknown public properties can be inventoried.
Boundary: External attack surface management (EASM) does not prove internal exploitability. Limit discovery to authorized domains and address ranges; do not scan unowned assets.
Cyber asset attack surface management
Aggregate inventories from endpoint detection, device management, cloud, identity, and configuration databases into one asset model and flag coverage gaps.
Boundary: Cyber asset attack surface management (CAASM) is an inventory and ownership layer above scanners. It is not a replacement for authenticated assessment or for a configuration-management database on its own.
Breach and attack simulation
Run controlled simulations of attacker techniques against email, web, endpoint, and network controls, often mapped to MITRE ATT&CK, to test selected behaviors.
Boundary: Breach and attack simulation (BAS) tests chosen control behaviors. Automated penetration testing may attempt broader exploit chains. Both need scope, stop conditions, and environment-specific safety checks.
Attack-path analysis
Graph how identities, misconfigurations, and Common Vulnerabilities and Exposures (CVEs) chain toward named crown-jewel assets so choke points can be inspected.
Boundary: A graph inference is not the same as a live exploit in an authorized test. Twin fidelity and production safety must be demonstrated on the estate under review.
Exposure orchestration
Deduplicate scanner findings, attribute owners, apply KEV, EPSS, and business context, and drive tickets with exception and re-validation evidence.
Boundary: Orchestration is not another scanner and is not CTEM by itself. Deduplication quality, owner inference, and export of findings remain local tests.
How the work flows
Scope owned services
Name business services, internet-facing systems, operational technology, identities, and third-party edges in scope. Exclude unowned assets. Record who may authorize discovery, validation, and change windows before any scan or simulation runs.
Discover assets and weaknesses
Use CAASM-style aggregation for what exists, authenticated vulnerability management and agents for what is weak, and EASM only against authorized domains and address ranges. Measure credentialed versus unauthenticated coverage and coverage gaps such as missing endpoint detection or single sign-on.
Prioritize with separate signals
Treat KEV as evidence of known exploitation, EPSS as a 30-day exploitation-likelihood estimate, and CVSS as technical severity. Combine those with reachability and business impact. Record compensating controls when a patch is deferred, following NIST SP 800-40 accept or mitigate options. Do not hide the ingredients in one unexplained vendor score.
Validate on authorized systems
Use BAS or authorized automated testing to confirm that controls actually block a path. Validate only lab or otherwise authorized systems. A control simulation, a graph inference, and a live exploit are different proofs; label which one you have.
Mobilize owners and re-assess
Route tickets to named owners with service-level expectations, change windows, and evidence of fix. Re-scan or re-validate after the change. Keep exception quality and exportable evidence suitable for later audit packets. Stop if traffic leaves the authorized range or uses real regulated data.
The environment changes the question
Use these scenarios to adapt the evaluation to your organization. They describe operational concerns, not a determination of compliance.
Finance ↗
A payment environment needs internet-exposure and identity-path findings reconciled with scan evidence used for examination packets, without mixing a compliance backlog into operational urgency.
Evaluate: Keep approval, exception, and remediation evidence exportable so a reviewer can see why a finding was patched, mitigated, or accepted.
Utilities ↗
Availability and physical safety constrain collection and testing on operational technology. Asset ownership, protocol compatibility, vendor guidance, and approved maintenance windows come before broad scans.
Evaluate: Validate mitigation when immediate patching is impractical, and adjust enterprise information-technology assumptions using operational-technology guidance such as NIST SP 800-82.
Manufacturing ↗
Long-lived equipment, integrator remote access, plant segmentation, and systems without agents mean a new endpoint agent or active test may be unacceptable on a production controller.
Evaluate: Prove discovery against representative devices in an approved window before any plant-wide scan or validation exercise.
Healthcare ↗
Ordinary hospital information technology and medical devices have different owners. Device changes can require manufacturer and clinical coordination, and test data must stay synthetic.
Evaluate: Keep patient-safety review in the workflow and distinguish device-lifecycle change control from routine workstation patching.
Public sector ↗
Deployment availability, data residency, export controls, and the exact rules applicable to the organization can differ from commercial cloud defaults, including government-cloud feature gaps.
Evaluate: Demonstrate public-sector feature parity and export of findings rather than inferring them from a commercial product page.
What drives the operating cost
- How assessed assets, cloud resources, and monitored external assets are counted, including duplicates, ephemeral workloads, and acquired estates.
- Module entitlements for validation, operational-technology sensors, patching, and orchestration; a platform name does not establish bundle contents.
- Scanner infrastructure, credential management, application-programming-interface limits, support, implementation, and staff triage effort.
- Open-source licensing can reduce a license line while leaving hosting, feed maintenance, and triage work with the operator.
Questions worth asking
- How do we measure assets that were not successfully assessed?
- Can findings be linked to an owner and validated after remediation?
- How does known exploitation affect the queue?
Common assumptions to check
Buying an exposure or CTEM platform is the same as running a CTEM program.
CTEM is an organizational cycle of scope, discovery, prioritization, validation, and mobilization. Tools can support those steps; they do not replace named owners, authorized scope, or recorded accept-or-mitigate decisions.
A single vendor risk score can replace CVSS, EPSS, KEV, reachability, and business impact.
Those signals measure different things. Mixing them without showing the ingredients hides why two identical CVEs can have opposite urgency. EPSS is not a complete risk score, and KEV is not exhaustive of all exploitation.
If a control simulation did not fire, the path is not exploitable, so unowned internet assets can be tested freely.
BAS that never executes an exploit can overstate control success, while automated tests that do execute can disrupt production if change control is weak. Do not scan or exploit unowned assets.
APPLY THE IDEA / EVALUATION PLAN
Make the outcome observable.
Compare an internet-facing exploited weakness with a high-severity issue on an isolated test system. Explain which uncertainty you would resolve first.
Build an isolated lab with planted conditions
An owned virtual network contains Windows and Linux images with outdated packages, a misconfigured identity role, a stale public DNS record on a domain you own, an endpoint-detection gap host, and a documented compensating web-application-firewall rule. Snapshot baselines before tools run.
Discover and separate prioritization signals
Point inventory adapters and an authenticated scanner at the lab only. Export findings with CVSS, EPSS, and KEV flags as separate columns. Reviewers document expected priority for a planted KEV-class flaw, a high-CVSS low-EPSS flaw, and a reachable identity misconfiguration with no CVE, then test whether the console exposes enough evidence to reproduce that decision.
Validate safely and prove a fix
Run lab-scoped BAS or authorized automated testing against lab controls only. Open tickets to named owners, apply a patch or control, and re-assess. Success is planted assets found, validation remaining inside the lab, and a verified close with exportable evidence. Any traffic leaving the lab range, any unowned address, or any real patient or cardholder data fails the exercise.
Use synthetic data and an authorized test environment. Record scope, product edition, permissions, results, and recovery behavior.
Vendors & products
14 profilesAn editorial selection of relevant offerings, with documented scope and practical evaluation questions. Atlas Fold provides a separate provisional documentation assessment for selected offerings; inclusion in this directory is not a ranking.
Tenable / Exposure management platform
Tenable One
The family spans information technology, cloud, operational technology, identity, and attack-surface modules plus third-party connectors. Entitlements, connector fidelity, and permissions for automated actions are separate from the platform name.
Qualys / Vulnerability management and TruRisk platform
Qualys VMDR
Cloud agents, passive sensors, and container sensors sit beside network scanning. Assessment coverage and remediation-module entitlements should be treated as separate commercial and operational questions, including how TruRisk relates to KEV and EPSS.
Rapid7 / Hybrid exposure management
Rapid7 Exposure Command
InsightVM remains the assessment engine inside the exposure SKU. Package entitlements, InsightVM migration, cloud-workload coverage, and retained evidence need to be confirmed per contract; the family name does not list those contents.
Microsoft / Exposure graph and Defender vulnerability management
Microsoft Security Exposure Management
The vulnerability-management user interface now sits under Exposure Management, while Defender Vulnerability Management and Defender EASM remain related capabilities with their own requirements. License stacking, including Microsoft 365 E5 versus standalone, and government-cloud gaps must be confirmed rather than inferred.
CrowdStrike / Agent-centric exposure management
CrowdStrike Falcon Exposure Management
How much assessment depends on the Falcon agent should be validated on the estate, including unmanaged devices and non-Falcon endpoints. Third-party scanner ingest, operational-technology and Internet of Things claims, and Fusion playbooks need their own authorization and safety review.
Cisco / Legacy risk-based vulnerability management
Cisco Vulnerability Management
This is not a current purchase path. End of sale is 10 March 2026 and last support is 30 June 2028. Remaining work is inventory, export, and successor design on the remaining support term, not new licenses.
Legacy / migration contextAxonius / Cyber asset attack surface management
Axonius Cyber Assets and Exposures
The product is an aggregation and ownership plane, not a replacement scanner. Adapter quality for the local stack, configuration-database reconciliation, write-back safety, and the separate Exposures product are the evaluation surface.
runZero / Agentless discovery and exposure workflow
runZero
The product still publishes as runZero. An 18 June 2026 agreement for Accenture to acquire runZero and NetRise is distinct from a majority investment in Dragos; completion was not established in reviewed sources. Safe operational-technology scanning remains an evaluation item.
Brinqa / Exposure orchestration
Brinqa Platform
Connectors, owner inference, and graph correctness are the product surface. PlexTrac integration depth is a separate evaluation after the August 2026 acquisition. Deduplicated tickets still need to match source scanners and exception history.
XM Cyber / Attack-path analysis
XM Cyber
Graph output is an inference about paths, not proof of a live exploit. Twin fidelity, production safety, and operational-technology or industrial-control path claims must be demonstrated on representative systems. Continuous exposure management here is a graph program, not a scanner replacement.
Cymulate / Breach and attack simulation
Cymulate Exposure Validation
Simulations need payload-safety review, an expected effect on security-operations alert volume, and an honest map of coverage versus the control vendors in place. A simulation that never executes an exploit is not the same proof as an authorized penetration test.
Picus Security / Exposure validation and breach and attack simulation
Picus Autonomous Exposure Validation Platform
BAS, attack-path validation, and cloud modules are not automatically one entitlement. Security-information-and-event-management and endpoint-detection integrations, mitigation content mapped to specific vendors, and deployment choices should be verified against the package under review.
Pentera / Automated security validation
Pentera Platform
Each module has its own authority question: network tests, cloud identity scope, and internet-surface assessment against owned properties only. Live exploits and BAS-style simulations both need authorization, change control, and stop conditions; neither is exempt.
Greenbone / Open-ecosystem vulnerability scanner
Greenbone OPENVAS SCAN
Community versus Enterprise feed coverage, authenticated scan quality, distributed management, and support responsibilities sit with the operator. Open-source licensing reduces a license line while leaving hosting, feed maintenance, and triage work. The scanner inventories weaknesses; it is not CTEM or EASM by itself.