Attack Surface Ranked

DEFINITION · SCORED SEPTEMBER 2026 · CROWDSTRIKE EASM ADDED 13 OCTOBER 2026

What is CTEM (continuous threat exposure management)?

Quick answer

CTEM, continuous threat exposure management, is a security program rather than a product. Gartner describes it as 'a pragmatic and systemic approach' to continually evaluate the accessibility, exposure and exploitability of digital and physical assets. ASM tools supply much of the discovery and validation a CTEM program depends on.

Scored September 2026 · CrowdStrike EASM added 13 October 2026 · Drawn from vendor product pages, docs and public pricing

How does Gartner define CTEM?

"Continuous threat exposure management (CTEM) is a pragmatic and systemic approach organizations can use to continually evaluate the accessibility, exposure and exploitability of digital and physical assets."

Gartner also forecasts that by 2026, organizations prioritizing their security investments based on a CTEM program will realize a two-thirds reduction in breaches (same press release, and Gartner's 16 October 2023 strategic technology trends release).

Gartner's guidance in that release is to align assessment and remediation with threat vectors or business projects rather than with infrastructure components alone.

Is CTEM a product you can buy?

No. It is a way of running exposure management continuously instead of in periodic assessments. Vendors across attack surface management, vulnerability management and exposure validation market their products as CTEM tools, but a program needs scope decisions, owners and remediation agreements that no single tool supplies.

Where do ASM tools fit in a CTEM program?

In practice a CTEM program loops through deciding what is in scope, finding what exists, working out what matters, proving what is exploitable and getting it fixed. ASM tools are strongest at finding what exists outside the perimeter, and the better ones also prove exploitability and help drive the fix.

Where do ASM tools fit in a CTEM program?
Program activityWhat an ASM tool contributesTools that document it
Scope: include subsidiaries, acquisitions and suppliersAttribution of assets to entitiesIONIX, CyCognito, watchTowr
DiscoverExternal asset discoveryAll 10
PrioritizeRisk scoring with business context, EPSS, KEVAll 10 in some form
ValidateExploitability proofIONIX, CyCognito, watchTowr, Hadrian
Mobilize fixesTickets, owners, compensating controls, retestsIONIX, watchTowr, Cortex Xpanse (compensating control); CyCognito, Hadrian (retest)

The activity names here are our plain-language description of a CTEM cycle. Gartner's full framework is published in its subscriber research.

What should a CTEM program ask of an ASM tool?

  • Can it find assets we did not list, including in subsidiaries, and show why each belongs to us?
  • Does it prove exploitability, and how safely?
  • Does each finding arrive with an owner and a ticket?
  • Can it apply a compensating control while a patch is pending?
  • Does it retest after the fix?

See how ten ASM tools answer these questions

Frequently asked questions

What does CTEM stand for?

Continuous threat exposure management.

Who created the CTEM framework?

Gartner. It describes CTEM in its research and public press releases.

What is the difference between CTEM and ASM?

CTEM is a program; ASM is a category of tools that supply external discovery and, in the better cases, validation and remediation support to that program.