Exposure and threat
The shift is from counting vulnerabilities to managing exposure: which weaknesses can actually be reached and used, on the things the business cares about. Continuous threat exposure management is a way of working that joins scoping, discovery, prioritisation, validation and mobilisation, not a single product.
New to this? The simple version
Field notes
- Vulnerability counts are the wrong number
A falling count of open vulnerabilities feels like progress and says little about risk. What matters is which weaknesses an attacker can reach and use, on the things the business depends on, and how fast those get closed.
Tools
- CTEM
Continuous Threat Exposure Management, and a capability self-assessment.
Personal work and my own view, not my employer's. Sources are public.