CTEM, continuous threat exposure management, is a program idea built around a short list of terms that people use interchangeably: exposure, vulnerability, threat, risk, attack path and validation. They are different things. This glossary defines each in plain words and says where they are confused.
The term CTEM comes from Gartner. Their reports are paywalled and were not read for this post, so the entries below are working definitions drawn from common practice and public standards. Check them against your own vendor's usage.
The core five
Asset. Anything worth protecting or that can be used to reach something worth protecting: a server, an account, a repository, a cloud bucket, a domain. NIST SP 800-53 control CM-8 asks for an inventory of system components that is accurate and complete. Most exposure problems start with an asset nobody listed.
Vulnerability. A weakness in software, configuration or process. A missing patch is a vulnerability. A login page is not, until something about it is weak.
Exposure. A weakness that can be reached. A vulnerable library inside an isolated batch job and the same library in a public API carry the same vulnerability and different exposure. This is the idea that gives CTEM its name.
Threat. Someone or something that might act: a criminal group, an insider, malware. Threat is about intent and capability, not about your systems.
Risk. The likelihood and impact of harm when a threat meets an exposure on an asset that matters. Risk needs all three parts. A scanner can list vulnerabilities, and only a person who knows the business can judge impact.
Terms about finding things
Discovery. Learning what assets exist. It can use scans, cloud APIs, identity data and device management.
Scanning. Testing assets for known weaknesses. Scanning finds vulnerabilities, and does not say whether they matter.
Attack surface. The set of places where an attacker could try to interact with your systems.
Shadow asset. Something running that the owner team did not register or approve. Often the first item a discovery effort turns up.
Terms about deciding what matters
Prioritization. Ordering work. Inputs can include severity, exploit evidence, asset importance and reachability. FIRST publishes EPSS, a freely available score that estimates exploitation likelihood, and CISA publishes a catalog of known exploited vulnerabilities. Each is one input among several.
Severity. A rating of how bad a weakness could be in general. It ignores your environment. A high severity issue on an unreachable test box may rank below a medium one on a public service.
Exploitability. Whether an attack technique exists and works in practice. Related but distinct from exposure.
Reachability. Whether vulnerable code is actually used. In application security, a vulnerable function that your code never calls is less urgent than one on a hot path.
Attack path. A chain of steps from an entry point to something valuable, such as a stolen token leading to an admin role leading to a database. Paths explain why two modest weaknesses together can matter more than one big one.
Terms about proving it
Validation. Confirming that an exposure can really be used, or that a control really blocks it. Done with non-destructive checks, tests or simulation, and with permission.
Penetration test. A scoped, time-limited attempt to break in, done by people. It samples. CTEM aims for continuous validation between those samples.
Breach and attack simulation. Automated tests that mimic known techniques against your controls. MITRE ATT&CK, a knowledge base of adversary behavior, is a common source for the technique list.
Terms about getting it fixed
Mobilization. Getting owners to act: tickets, due dates, approvals. Often the weakest step.
Remediation. Removing or reducing the exposure by patching, reconfiguring or closing access.
Compensating control. Something that reduces risk when you cannot fix directly, such as a filter in front of an old system.
Risk acceptance. A recorded decision to live with an exposure, with an owner and an expiry date.
Terms often mixed up
Vulnerability vs exposure: reachable or not. Severity vs risk: general or specific to you. Scanning vs validation: listing versus proving. Remediation vs mitigation: removing versus reducing.
What to do
- Share these definitions with the people who read your reports.
- Ask vendors to define exposure and validation as they use them.
- Add reachability and asset importance to how you rank findings.
- Record risk acceptances with owners and expiry dates.
Quick check
Is every vulnerability an exposure?
No. A vulnerability becomes an exposure when an attacker can reach it. Reachability and access paths decide that.
Is CTEM a tool?
It is a program approach. Tools and services can support parts of it.
Sources
- NIST SP 800-53 Rev. 5, control CM-8 (OSCAL catalog)
- FIRST, Exploit Prediction Scoring System
- CISA Known Exploited Vulnerabilities Catalog
- MITRE ATT&CK FAQ
Last reviewed: 18 October 2026.
