A small team can start an exposure management cycle in 90 days by doing one narrow pass: pick a scope, list what is exposed, rank it by business importance, test the top few items, and fix them with named owners. Aim for one completed loop, not full coverage.
The stage names below follow the widely used five stage description of CTEM. We could not read Gartner's own page for this review, so verify naming against its current material if you quote it.
Days 1 to 15: scope
Choose one slice of the business. A customer-facing product is a good start. Write down its domains, cloud accounts, repositories and the people who run it.
Decide what "exposure" means for this pass. Keep it plain: anything reachable from the internet, plus any SaaS tool with access to production data.
Days 16 to 40: discover
Build the list. Useful sources are:
- DNS zones and registrar records
- Cloud account inventories
- Certificate transparency logs for your domains
- Code repositories and deployment configs
- SSO and OAuth app lists
Mark every line with an owner. Anything without one goes on a separate "unclaimed" list.
Days 41 to 55: prioritize
Rank each item with three questions:
- What does it touch, and how bad would loss be?
- Is it reachable without logging in?
- Is there a vulnerability on it that is known to be exploited in the wild?
For the third question, CISA says organisations should use its Known Exploited Vulnerabilities catalog as an input to their prioritization framework. Use it as an input, not the only one.
Days 56 to 75: validate
Take the top ten. For each, confirm the exposure is real and the risk is real. A flaw in a library that your code never calls is a different case from a flaw on a public login page. Where you can, run a safe test or review the attack path rather than trusting a severity score.
Days 76 to 90: mobilize
Turn each confirmed item into a ticket with an owner and a date. Review weekly. Close the unclaimed list by assigning or deleting. At day 90, write one page: what you found, what you fixed, what remains, and what you will change in the next loop.
Common failure points
- Scope too wide, so nothing finishes
- No owners, so findings sit
- Severity scores used as the only ranking
- No second pass, so the list goes stale
Where Safeguard fits
For the software part of your scope, Safeguard offers asset discovery, dependency scanning, reachability analysis and policy gates, with autonomous remediation fix PRs available but off by default. It does not cover external attack surface, SaaS posture or exposure management as a category.
Quick check
How many people does this take?
One person with part-time support from engineering and IT can complete a first narrow loop. The limit is owner response time, not tooling.
Sources
Last reviewed: 19 October 2026.
