Continuous Threat Exposure Management (CTEM)
Continuous Threat Exposure Management (CTEM) is a strategic, cyclical, and continuous cybersecurity use case designed to manage an organization's security posture by constantly identifying, prioritizing, and mitigating real-world threats across its entire external attack surface. It moves beyond traditional, reactive vulnerability scanning by focusing on exposures that an actual attacker could use and actively exploit. CTEM establishes a formal program that validates and prioritizes risk based on threat intelligence, ensuring security efforts are aligned with the most probable attack paths.
ThreatNG, as an all-in-one External Attack Surface Management (EASM), Digital Risk Protection (DRP), and Security Ratings solution, directly enables the core phases of a CTEM program by providing a perpetual, unauthenticated, attacker's view of an organization's digital presence.
ThreatNG's Role in Continuous Threat Exposure Management
External Discovery and Continuous Monitoring
ThreatNG supports the foundational scoping and discovery phases of CTEM through its External Discovery capability. This involves performing a purely external, unauthenticated discovery with no connectors, mirroring an adversary's reconnaissance. By maintaining Continuous Monitoring, ThreatNG ensures that the attack surface inventory is always current.
Example of ThreatNG Helping: A company acquires a new subsidiary that has several public-facing assets, including a cloud storage bucket and a forgotten
test.olddomain.comsubdomain. ThreatNG automatically discovers and inventories these assets, immediately bringing them under the CTEM program's scope so they can be assessed and monitored, preventing shadow IT from becoming an initial access vector.
External Assessment
ThreatNG’s External Assessment capabilities directly feed the prioritization and validation phases of CTEM by scoring and classifying risk from an attacker's perspective. It assesses exposure across multiple vectors:
Cyber Risk Exposure: This score is derived from checking for fundamental security weaknesses.
Example: ThreatNG discovers an unpatched web server on a public-facing asset with a known security flaw (a high-severity finding in the Vulnerabilities repository) and notes that an exposed sensitive port (like RDP or SSH) is open. This combination results in a high Cyber Risk Exposure score, signaling a clear, prioritized target for the CTEM team.
Subdomain Takeover Susceptibility: This assesses the risk of hijacking a subdomain pointing to an unclaimed external service.
Example: A retired development environment's subdomain,
dev.staging.corp.com, is found to have a CNAME record pointing to an external cloud resource (e.g., an AWS S3 bucket) that is no longer active. ThreatNG flags this high Subdomain Takeover Susceptibility because an attacker could register the abandoned resource name and take control of the subdomain for malicious purposes, requiring immediate DNS remediation.
BEC & Phishing Susceptibility: This evaluates an organization's weakness to social engineering.
Example: ThreatNG finds that the company's main domain has a weak DMARC policy (a finding from Email Intelligence) and identifies dozens of newly registered domain permutations (e.g.,
company-support.net) that could be used for phishing, combining these factors to elevate the overall susceptibility score.
Investigation Modules
The Reconnaissance Hub and its modules are crucial for the validation phase of CTEM, enabling security teams to query the attack surface and gather forensic details actively.
Sensitive Code Exposure: This module actively searches public code repositories for accidental credential leaks.
Example: An analyst uses this module to investigate a newly discovered GitHub repository associated with the company and finds exposed AWS Access Key IDs and an unencrypted Database Credential string. This provides irrefutable evidence for the validation phase, immediately triggering credential rotation as a high-priority action.
Mobile Application Discovery: This module scans mobile application marketplaces for the organization's apps and scrutinizes the binaries for embedded secrets.
Example: A check reveals an exposed Stripe API Key or a plaintext PGP private key block (a type of Security Credential) accidentally left in the mobile app's code. This discovery validates a critical exposure, demanding an emergency app update and credential revocation.
Domain Intelligence (DNS & Subdomain Intelligence): This module enables in-depth analysis of an asset's infrastructure.
Example: Investigating an unexpected subdomain, the analyst uses Subdomain Intelligence to discover an exposed administrative interface (
admin.mycompany.com) that is not protected by multi-factor authentication and is running outdated, vulnerable software.
Intelligence Repositories and Reporting
ThreatNG’s Intelligence Repositories (like DarCache Vulnerability) drive the CTEM prioritization phase by fusing data from sources like NVD, EPSS (probabilistic exploitation likelihood), and KEV (known exploited vulnerabilities). The Overwatch system uses this data to assess the impact of new threats across the portfolio instantly.
The Reporting capability is vital for the mobilization phase. It provides easy-to-digest reports, including Security Ratings (A-F), Prioritized risk scores, and External GRC Assessment Mappings (e.g., to PCI DSS and HIPAA).
Example of Reporting Helping: A CISO uses the External GRC Assessment Mappings report to identify which discovered exposed sensitive ports directly violate PCI DSS control requirements, thereby providing clear, regulatory-driven justification to business leaders for immediate funding and remediation efforts.
Cooperation with Complementary Solutions
ThreatNG's external, threat-centric insights significantly enhance the effectiveness of internal security tools, creating a seamless CTEM lifecycle.
ThreatNG and a Security Information and Event Management (SIEM) Solution:
Cooperation: ThreatNG identifies external threats that are about to become internal incidents. When the Dark Web Presence module finds a large list of Compromised Credentials associated with the company, this high-fidelity external data is sent to the SIEM solution.
Example: The SIEM solution can then use these compromised credentials as a watch list, immediately generating an alert if any of those specific usernames attempt to log in to the internal network or critical applications, catching an attacker's initial breach attempt validated by ThreatNG's external discovery.
ThreatNG and a Vulnerability and Patch Management (VPM) Tool:
Cooperation: ThreatNG performs a risk-based prioritization of vulnerabilities exposed on internet-facing assets using its Intelligence Repositories (KEV/EPSS). This highly curated list, which represents the greatest external threat, is supplied to the VPM tool.
Example: Instead of patching thousands of vulnerabilities across the entire estate, the VPM tool can use the ThreatNG-prioritized list to focus resources only on the two or three most critical CVEs that are both exposed externally and are known to be actively exploited by ransomware groups (DarCache Ransomware). This ensures remediation resources are dedicated to the exposures most likely to cause a breach.
