--- title: CTEM 101: Moving From Spreadsheets to Continuous Risk... description: Continuous Threat Exposure Management (CTEM), a framework coined by Gartner around 2022, reframes vulnerability management as an ongoing five-stage cycle:... canonical: https://daily.dev/posts/ctem-101-moving-from-spreadsheets-to-continuous-risk-reduction-hsfcnuvyg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CTEM 101: Moving From Spreadsheets to Continuous Risk Reduction | daily.dev og:description: Continuous Threat Exposure Management (CTEM), a framework coined by Gartner around 2022, reframes vulnerability management as an ongoing five-stage cycle:... og:url: https://daily.dev/posts/ctem-101-moving-from-spreadsheets-to-continuous-risk-reduction-hsfcnuvyg og:image: https://api.daily.dev/og/posts/HsfCnUVYg.png og:image:alt: CTEM 101: Moving From Spreadsheets to Continuous Risk Reduction og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CTEM 101: Moving From Spreadsheets to Continuous Risk Reduction **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 8 min read · 0 upvotes · 0 comments ## Summary Continuous Threat Exposure Management (CTEM), a framework coined by Gartner around 2022, reframes vulnerability management as an ongoing five-stage cycle: scoping, discovery, prioritization, validation, and mobilization, rather than a one-time or purely reactive effort. Traditional vulnerability management is criticized for being reactive, weighting everything by CVSS score alone, and ignoring non-CVE risks like misconfigurations and exposed identities. CTEM instead ties prioritization to asset business value, validates true blast radius, and routes findings quickly to owners for remediation. Practical advice includes setting concrete goals, securing an executive sponsor, assessing organizational maturity, and avoiding buying tools without clear value. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the five stages of the CTEM (Continuous Threat Exposure Management) cycle? The five stages are scoping, discovery, prioritization, validation, and mobilization. Scoping inventories and tags assets by business value; discovery scans assets on a regular cadence; prioritization ranks findings by both vulnerability severity and asset value rather than CVSS score alone; validation confirms true blast radius and control effectiveness; mobilization routes findings to the owner who can fix them quickly. _daily.dev surfaces practical security frameworks like this for teams building continuous risk reduction programs._ ### How is CTEM different from traditional vulnerability management? Traditional vulnerability management is reactive, waiting for scan results or reports, and focuses narrowly on known CVEs ranked mostly by CVSS score. CTEM is both proactive and reactive, continuously scoping and discovering exposure, and expands scope to cover misconfigurations, exposed identities, and third-party risk, weighting prioritization by asset business value rather than severity score alone. _Teams weighing vulnerability management approaches can track frameworks like CTEM on daily.dev._ ### What practical steps should a team take before starting a CTEM program? Set concrete, measurable goals rather than vague ones, such as eliminating all critical findings on crown jewel assets within 90 days or cutting high-severity issues by 70% on edge devices. Secure an executive sponsor to enforce cross-team remediation cooperation, assess current security maturity to identify which gaps to close first, and avoid buying new tools without confirming they genuinely reduce risk rather than add noise. _daily.dev helps security engineers planning risk reduction initiatives stay on top of practical frameworks like this._ ## Similar posts on daily.dev - [CTEM can give your security team a contextual edge](https://daily.dev/posts/ctem-can-give-your-security-team-a-contextual-edge-hqgbi3nhx) · CSO Online · 0 upvotes · 0 comments - [SPONSORED: Drowning in CVEs and thirsty for answers? Try CTEM](https://daily.dev/posts/sponsored-drowning-in-cves-and-thirsty-for-answers-try-ctem-kpha3scha) · The Register · 0 upvotes · 0 comments - [When CTEM, AI and a unified attack surface meet](https://daily.dev/posts/when-ctem-ai-and-a-unified-attack-surface-meet-bg4qrirnn) · TechCentral · 0 upvotes · 0 comments - [Can CTEM Apply to Credential Security](https://daily.dev/posts/can-ctem-apply-to-credential-security-mbbiya1dn) · Security Boulevard · 0 upvotes · 0 comments - [CTEM validation with Tenable One](https://daily.dev/posts/ctem-validation-with-tenable-one-p3xb6ccsx) · Tenable Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/ctem-101-moving-from-spreadsheets-to-continuous-risk-reduction-hsfcnuvyg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CTEM 101: Moving From Spreadsheets to Continuous Risk Reduction","url":"https://daily.dev/posts/ctem-101-moving-from-spreadsheets-to-continuous-risk-reduction-hsfcnuvyg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ctem-101-moving-from-spreadsheets-to-continuous-risk-reduction-hsfcnuvyg"},"datePublished":"2026-08-23T12:22:32.947Z","dateModified":"2026-08-23T12:46:25.583Z","description":"Continuous Threat Exposure Management (CTEM), a framework coined by Gartner around 2022, reframes vulnerability management as an ongoing five-stage cycle:...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd048316927b934a9c4ded63f8cba1cf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd048316927b934a9c4ded63f8cba1cf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ctem-101-moving-from-spreadsheets-to-continuous-risk-reduction-hsfcnuvyg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"CTEM 101: Moving From Spreadsheets to Continuous Risk Reduction"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ctem-101-moving-from-spreadsheets-to-continuous-risk-reduction-hsfcnuvyg#faq","mainEntity":[{"@type":"Question","name":"What are the five stages of the CTEM (Continuous Threat Exposure Management) cycle?","acceptedAnswer":{"@type":"Answer","text":"The five stages are scoping, discovery, prioritization, validation, and mobilization. Scoping inventories and tags assets by business value; discovery scans assets on a regular cadence; prioritization ranks findings by both vulnerability severity and asset value rather than CVSS score alone; validation confirms true blast radius and control effectiveness; mobilization routes findings to the owner who can fix them quickly. daily.dev surfaces practical security frameworks like this for teams building continuous risk reduction programs."}},{"@type":"Question","name":"How is CTEM different from traditional vulnerability management?","acceptedAnswer":{"@type":"Answer","text":"Traditional vulnerability management is reactive, waiting for scan results or reports, and focuses narrowly on known CVEs ranked mostly by CVSS score. CTEM is both proactive and reactive, continuously scoping and discovering exposure, and expands scope to cover misconfigurations, exposed identities, and third-party risk, weighting prioritization by asset business value rather than severity score alone. Teams weighing vulnerability management approaches can track frameworks like CTEM on daily.dev."}},{"@type":"Question","name":"What practical steps should a team take before starting a CTEM program?","acceptedAnswer":{"@type":"Answer","text":"Set concrete, measurable goals rather than vague ones, such as eliminating all critical findings on crown jewel assets within 90 days or cutting high-severity issues by 70% on edge devices. Secure an executive sponsor to enforce cross-team remediation cooperation, assess current security maturity to identify which gaps to close first, and avoid buying new tools without confirming they genuinely reduce risk rather than add noise. daily.dev helps security engineers planning risk reduction initiatives stay on top of practical frameworks like this."}}]} ```