EASM, external attack surface management, finds and monitors your internet-facing assets from the outside. CTEM, continuous threat exposure management, is a wider program that covers internal and external exposure and adds validation and fixing. EASM is one input to CTEM. Start with EASM for blind spots, and choose CTEM when the problem is turning findings into fixes.
What does EASM cover?
EASM looks at what an outsider can see: domains, subdomains, IP addresses, certificates, cloud storage, login pages, exposed services. Its strength is discovery of things you did not know existed. Its limit is the view. By design it sees only what is reachable from outside, so it says little about internal systems, identity configuration or code.
What does CTEM cover?
CTEM is a program idea, with the term coming from Gartner. Their research is behind a paywall and was not read for this post, so the description here is general. In practice a CTEM program loops through scoping, discovery, prioritization, validation and mobilization. It spans assets inside and outside, including identities, cloud settings, software and SaaS. The loop is the point: findings must reach owners and be verified fixed.
How do they differ?
Focus. EASM looks at internet-facing assets. CTEM looks at all exposure, inside and outside.
Nature. EASM is a capability, often a product. CTEM is a program, supported by tools and process.
Output. EASM produces a list of external assets and issues. CTEM produces validated, prioritized work that owners complete.
Main risk if done alone. EASM alone gives findings without owners. CTEM alone can have a scope too wide to finish.
This split simplifies. Vendors blur these lines, and some products sold as EASM include validation, while some CTEM platforms include external discovery.
Where do they overlap?
Both start with an inventory. NIST SP 800-53 control CM-8 asks for one that is accurate and complete, and both approaches reveal gaps in it. Both use outside signals to rank work: CISA's Known Exploited Vulnerabilities Catalog and FIRST's EPSS scores are free inputs either can use. Both depend on owners. And NIST SP 800-137 describes continuous monitoring as an ongoing program, which suits both.
When do you need EASM?
You need EASM, or at least a disciplined manual version, when you suspect unknown public assets. Signs include many domains, frequent cloud account creation, acquisitions, agencies running campaign sites, or a past surprise where a forgotten server turned up. EASM answers "what is exposed that we did not list".
When do you need CTEM?
You need a CTEM style program when discovery is not your bottleneck. You have scanners, you have long lists, and issues stay open. The gaps are prioritization, proof that an issue can be used, and getting teams to fix. CTEM answers "which exposures matter, who fixes them, and did the fix hold".
Do you need both?
Often you need the habits of both, in order. A small company can start with a manual external review: domains, cloud accounts, public services, owners. When that is stable, extend to internal scope, add validation and build the loop with tickets and re-tests. Whether you buy tools for either is a separate decision. Many teams run the program with a mix of products and spreadsheets.
A constructed contrast
Company A runs an external scan and finds a forgotten test site. It never ran a proper fix process, so the site stays up for three months with an open ticket. Company B finds nothing new externally but has 4,000 open internal findings and no ranking. A is an EASM follow-through problem and B is a CTEM prioritization problem. The companies are invented.
Where does application security fit?
For both, a reachable application matters more if its vulnerable libraries are actually used. Reachability data from application analysis helps rank what EASM or CTEM discovers. It is application context that neither approach gathers on its own.
What to do
- Decide whether your bottleneck is discovery or follow-through.
- List external assets with owners, even in a spreadsheet.
- Define a loop: find, rank, validate, assign, re-test.
- Use KEV and EPSS as ranking inputs, then add business context.
- Add reachability data for exposed applications.
- Choose tools only after the process is clear.
Where Safeguard fits
Safeguard focuses on the application and software supply chain side, with dependency inventory and reachability analysis. It does not replace EASM or CTEM platforms, and can supply validated application findings to either.
Quick check
Is EASM part of CTEM?
Generally yes. External discovery is one input to a broader exposure program, though vendors package them differently.
Which should a ten person company start with?
A manual external review with owners, since it is cheap and finds the common surprises. Add program structure as you grow.
Sources
- NIST SP 800-53 Rev. 5, control CM-8 (OSCAL catalog)
- NIST SP 800-137, Information Security Continuous Monitoring
- CISA Known Exploited Vulnerabilities Catalog
- FIRST, Exploit Prediction Scoring System
Last reviewed: 18 October 2026.
