CTEM explained: continuous threat exposure management in plain terms

How does Gartner describe CTEM?

Continuous threat exposure management (CTEM) is a pragmatic and systemic approach organizations can use to continually evaluate the accessibility, exposure and exploitability of digital and physical assets.

In the same release, and in its strategic technology trends release of 16 October 2023, Gartner forecasts that by 2026 organisations prioritising their security investments based on a CTEM programme will realise a two-thirds reduction in breaches. That is Gartner's forecast, not a measured result, and 2026 is the year it refers to.

Source: Gartner press release: top 10 strategic technology trends for 2024 · Read 27 Sep 2026

Gartner's guidance in the 2024 release is to align assessment and remediation with threat vectors or business projects rather than with infrastructure components alone.

What does a CTEM cycle look like?

Gartner's full framework, including its own names for the stages, is in its subscriber research, which we have not reproduced. What follows is our plain-language description of what teams running a CTEM programme do in each cycle.

1. 01Decide what is in scope. Pick a business service, a set of subsidiaries or a class of assets for this cycle, rather than the whole estate at once.
2. 02Find the assets and exposures. Build an inventory of what is in scope, including assets nobody listed, and the exposures on each.
3. 03Rank by what matters. Order the findings by business impact and by evidence of exploitation, such as the CISA KEV catalog or EPSS, not by severity score alone.
4. 04Prove what is real. Test which of the top findings an attacker could actually use, so the work goes to exposures that are exploitable.
5. 05Get fixes done. Route each fix to its owner, apply a compensating control where the fix will take time, confirm the fix worked, and report the change in exposure.

Then the cycle starts again, often with a different scope.

Where do the CISA KEV catalog and EPSS fit?

Two public signals help with ranking. CISA's Known Exploited Vulnerabilities catalog lists vulnerabilities with reliable evidence of active exploitation and a clear remediation action. FIRST's Exploit Prediction Scoring System estimates the probability that a published vulnerability will be exploited in the next 30 days, as a value from 0 to 1 published daily. CVSS, also maintained by FIRST, scores severity, not likelihood.

Source: CISA Known Exploited Vulnerabilities Catalog · Read 27 Sep 2026

Source: FIRST: Exploit Prediction Scoring System · Read 27 Sep 2026

Source: FIRST: Common Vulnerability Scoring System · Read 27 Sep 2026

FIRST's mid-year forecast for 2026 projects about 66,000 CVEs, up from its February median of 59,427. It also notes that when filtered for real-world risk (CISA KEV entries or EPSS above 10%) the patching burden has not materially increased. That is the case for ranking and proof: the list grows, but the part that matters grows much less.

Source: FIRST: mid-year 2026 forecast update · Read 27 Sep 2026

Source: FIRST: 2026 vulnerability forecast · Read 27 Sep 2026

What CTEM is not

• Not a product. A vendor can support the cycle; it cannot be the programme.
• Not a scan schedule. Running the same scan every week without scoping, ranking and proof is vulnerability management under a new name.
• Not a guarantee. Gartner's two-thirds figure is a forecast for organisations that prioritise investments based on a CTEM programme.

How do you start?

Pick one scope you can finish in a cycle, often the internet-facing assets of one business service or one recent acquisition. Run the finder with that scope in mind; it will show which tool types your answers point to and which vendors' pages describe them.