Get a Demo
Menu

How mature is your vulnerability management program?

Answer 18 questions and get your maturity level, your two biggest gaps, and a business case you can take to leadership. Your answers stay in your browser.

Start the assessment

Assessment, 18 questions, about 15 minutes

What is this?

A calculator to measure the readiness of your vulnerability management program to continuous threat exposure management.

Why CTEM?

Vulnerability management was designed for a static world (fewer assets, slower change, and simpler infrastructure). The world has changed.

Today, security teams face an environment where assets multiply faster than scanners can reach, "vulnerability" means far more than CVEs, and the gap between finding a problem and fixing it is where breaches happen.

Traditional VM programs (built around periodic scans, CVSS-driven triage, and patch-count metrics) can't keep pace. They measure activity. They don't reduce exposure.

Continuous Threat Exposure Management (CTEM) is a framework for tackling these challenges, shifting the operating model from reactive vulnerability remediation to continuous exposure reduction. It treats the full attack surface (CVEs, misconfigurations, identity exposures, cloud posture gaps) as a single, continuously managed risk domain.

Why this assessment?

This assessment:

  • Turns intuition into evidence. You probably know your VM program has gaps. This assessment quantifies them across six dimensions.
  • Reveals gaps you've normalized. Most teams have adapted to their program's limitations. This assessment surfaces those adaptations as measurable maturity gaps.
  • Maps your path from Vulnerability Management to CTEM. Your results show which improvements yield the highest impact and what each maturity level looks like in practice.

What are the 18 questions?

18 questions across six dimensions. Pick the answer closest to how your program runs today.

The scoring tool needs JavaScript. With it off, every question is listed below. Each answer scores 2 for A, 1 for B, and 0 for C, so the 18 answers add up to a total from 0 to 36, and the total sets the level. The maturity levels further down turn your total into a level.

No data leaves your browser. Your answers are saved in this browser only, so a reload keeps them. Nothing is sent to Axonius or anyone else.

1of 18

1. Tool Integration

1.1 How are findings from your multiple tools (vulnerability scanners, EDRs, CMDBs, cloud security, identity tools, on-prem security, etc) brought together?

Why this matters. When your scanner says "patched," your EDR says "vulnerable," and your CMDB says the asset was decommissioned last quarter, someone is wrong. Without automated correlation, IT, Security, and GRC pros are all working from a different version of truth.

1.2 When two tools disagree about the state of an asset (e.g., patch status, configuration), or vulnerability (i.e. criticality, internet exposure) how is the conflict resolved?

Why this matters. Tool disagreements aren't rare edge cases. In most environments, 15-30% of assets and vulnerabilities show conflicting data. If you're not reconciling, you're making decisions on data you can't verify.

1.3 What percentage of your security-relevant data sources (vulnerability scanners, EDR, CMDB, cloud platforms, SAST/DAST, identity providers, SaaS inventory...) are integrated into a common view?

Why this matters. Every unintegrated data source is a blind spot. True security visibility runs from ground to cloud, not only in specific planes.

2. Asset Visibility

2.1 Does your asset inventory account for every type of asset : managed endpoints, unmanaged devices, cloud instances, containers, SaaS applications, OT/IoT, shadow IT, and BYOD?

Why this matters. You can't protect what you can't see. Every unmanaged device, cloud instance, and SaaS integration is invisible. Attackers don't limit themselves to your managed inventory.

2.2 For a given asset, can you immediately determine: who owns it, what business process it supports, what data it handles, who has access, and what its internet exposure is?

Why this matters. An inventory that tells you what exists is necessary. An inventory that tells you why it matters is what lets you prioritize.

2.3 How quickly do new assets appear in your inventory after they're created or connected to the network?

Why this matters. If your discovery cycle is weekly, you're not seeing assets during their most vulnerable window : freshly provisioned and potentially misconfigured.

3. Risk Prioritization

3.1 How do you decide which vulnerabilities, misconfigurations, or exposures to remediate first?

Why this matters. CVSS tells you nothing about your environment. A CVSS 9.8 on an isolated test server is less urgent than a CVSS 6.5 on your internet-facing payment database. Effective prioritization requires three layers of context.

3.2 Does your prioritization include non-CVE exposures : misconfigurations, excessive permissions, exposed services, cloud posture issues?

Why this matters. CVEs are only one category of exposure. Misconfigurations and overly permissive IAM roles account for a growing share of breaches.

3.3 When your environment changes : new asset deployed, user gains access, configuration drifts : does your risk prioritization update automatically?

Why this matters. Risk isn't static. If your risk scores don't update when the environment does, you're making decisions on stale data.

4. Remediation Workflow

4.1 When a remediation task is assigned, does the responsible team have full context: vulnerability, asset criticality, ownership, business impact, and remediation options?

Why this matters. Every minute spent figuring out who owns an asset or why it matters is a minute not spent fixing it. Under-contextualized tickets get deprioritized or closed as risk accepted by uninformed teams.

4.2 After remediation, how do you verify that the fix actually reduced the exposure?

Why this matters. Deploying a patch and reducing risk aren't the same thing. Without closed-loop verification, your remediation metrics measure effort, not outcomes.

4.3 How do security, IT, DevOps, and cloud teams coordinate on remediation priorities and timelines?

Why this matters. When teams don't share a common prioritization framework, security's critical competes with operations' backlog. Critical vulnerabilities sit in queues while teams negotiate priority.

5. Reporting & Metrics

5.1 Do your primary Vulnerability Management (VM) metrics (patch rate, MTTR, SLA compliance) reflect actual risk reduction, or operational throughput?

Why this matters. A 95% patch rate looks great. But if the 5% you missed includes your most critical assets, that metric hides your biggest risk. Activity metrics tell you the team is busy; risk metrics tell you the organization is safer.

5.2 Can you translate your VM data into language that drives executive decisions : business risk reduced, exposure trends by business unit, remediation ROI?

Why this matters. Your board thinks in business risk, not CVE counts. If you can't articulate risk reduction in business terms, you don't unlock budget, headcount, or executive sponsorship.

5.3 Can you show how your overall exposure posture is changing over time : not just vulnerability counts, but risk-weighted exposure trends?

Why this matters. A snapshot tells you where you are. A trend tells you whether you're getting better or worse and whether your investments are working.

6. Continuous Improvement

6.1 Do you have automation rules that enforce baseline security controls : such as deploying missing EDR agents, enabling MFA, or quarantining non-compliant assets?

Why this matters. If your team is writing tickets to install EDR or enable MFA, you're spending skilled analyst time on work that should be policy-driven. Every obvious fix that requires human intervention competes for your team's attention.

6.2 Can your security team build and modify automated workflows without requiring custom scripting or engineering resources?

Why this matters. Automation that only engineers can build doesn't scale. Security teams need to create and iterate on automation rules directly.

6.3 Does your program systematically identify recurring exposure patterns and convert them into automated prevention or remediation rules?

Why this matters. If you're remediating the same class of exposure every quarter, you're not improving : you're maintaining. A mature program converts patterns into automation.

Press 1, 2 or 3 (or A, B, C) to answer.

What is your maturity level?

of 36

Score per dimension, 0 to 6
Show the scores as a table
DimensionScore (0 to 6)LevelGap criticality

Your two biggest gaps

    No data leaves your browser. The share link holds your 18 answers and nothing else:

    This form is not connected yet, so nothing will be sent.

    Where are the biggest gaps?

    Review the dimensions below in order. Dimensions on Level 1 have critical gaps. Level 2 high, Level 3 medium or low (depending on the complexity of your environment).

    Tool Integration

    Your gap

    The gap
    Your tools operate independently with no unified view.
    What it costs you
    • Conflicting data creates analyst confusion and slows triage.
    • Different versions of truth lead to wrong remediation priorities.
    • Tool sprawl increases licensing costs and maintenance burden.
    Highest impact improvement
    Implement a unified asset and security finding inventory platform that correlates asset and exposures from all major tools (scanner, EDR, CMDB, cloud, identity). Establish data reconciliation rules to resolve conflicts automatically. This creates a single source of truth for all downstream security findings, prioritization, and remediation decisions.

    Asset Visibility

    Your gap

    The gap
    You don't know what you have, especially unmanaged, cloud, and ephemeral assets.
    What it costs you
    • Blind spots mean unmanaged endpoints, cloud instances, and SaaS apps operate outside your security program.
    • Lack of asset context prevents business-aware prioritization.
    • New assets created but not discovered during their most vulnerable window.
    Highest impact improvement
    Expand discovery to include unmanaged devices, cloud APIs, SaaS integrations, and identity-based inventory. Enrich asset records with ownership, business classification, data sensitivity, and network exposure. Automate discovery to operate continuously, not on scan cycles.

    Risk Prioritization

    Your gap

    The gap
    You prioritize by CVSS score alone, ignoring asset criticality and business context.
    What it costs you
    • Remediation efforts focus on loud vulnerabilities on unimportant assets.
    • True critical exposures get deprioritized because they have lower severity scores.
    • Resources are wasted patching what doesn't matter.
    Highest impact improvement
    Build a risk scoring model that combines three context layers: Security Context (severity, exploitability, threat intel), Asset Context (security posture, criticality, connectivity), and Business Context (data classification, business process, regulatory scope). Calculate risk continuously as security findings are introduced and environment changes.

    Remediation Workflow

    Your gap

    The gap
    Remediation tickets lack context, and fixes aren't verified to have reduced risk.
    What it costs you
    • Teams spend time looking up asset ownership instead of fixing problems.
    • Patches deploy without verification, leaving false sense of completion.
    • Cross-team handoffs cause delays and orphaned issues.
    Highest impact improvement
    Implement a workflow that auto-enriches tickets with asset context, criticality, ownership, and suggested remediation paths. Close the loop with automated verification: rescan after deployment and confirm risk score decreased. Establish unified SLAs across security, IT, DevOps, and cloud teams.

    Reporting & Metrics

    Your gap

    The gap
    Your metrics measure activity (patch count), not risk reduction.
    What it costs you
    • Board reports show busy-ness, not safety. Executives can't assess program value.
    • Patch rate metrics hide the reality that you're missing your most critical assets.
    • No data to show ROI on security investments.
    Highest impact improvement
    Shift metrics from activity (patch rate, SLA compliance) to outcomes (exposure reduction, risk-weighted trend). Report business-aligned metrics: "We reduced exposure to our top 20 critical assets by 60%." Show trend lines : is the organization getting safer? Connect security improvements to business metrics your board cares about.

    Continuous Improvement

    Your gap

    The gap
    Every finding requires a ticket. Recurring issues are never automated.
    What it costs you
    • Analysts spend time on routine tasks instead of novel threats.
    • Recurring exposure patterns repeat every cycle : no learning loop.
    • No feedback mechanism to prevent recurrence.
    Highest impact improvement
    Implement automation rules for routine enforcement (missing EDR, disabled MFA, non-compliant assets). Give security teams a workflow platform to create automation without engineering support. Systematically review remediation patterns and auto-prevent recurrence (i.e. if an asset consistently lacks MFA, auto-enable it).

    How do you make the case to leadership?

    Get the talking points to present findings and recommendations to your leadership.

    Tool Integration

    Your gap

    What's happening
    We're Managing Risk with Conflicting Data Silos
    Description
    Our security tools disagree about asset state and which vulnerabilities are critical. When the scanner says "patched" but the EDR says "vulnerable," someone is wrong. Without a unified view, we're making critical decisions on data we can't trust. This uncertainty delays remediation and creates blind spots.
    Cost of inaction
    Every tool silo and disagreement costs analyst time to investigate and solving conflicts. Conflicting data feeds wrong prioritization decisions and increases false negatives : missed exposures.

    Asset Visibility

    Your gap

    What's happening
    We can't confidently see all assets and the security issues they present
    Description
    Our visibility is limited to what our agent reaches or what our scanner can see. Unmanaged devices, cloud instances, shadow IT, and SaaS integrations operate outside our security program. These blind spots are exactly where attackers hide.
    Cost of inaction
    We're securing a fraction of our actual attack surface. New cloud resources deployed without security controls. SaaS applications added daily by business units. The gaps are growing faster than we can close them.

    Risk Prioritization

    Your gap

    What's happening
    We're Patching the Loudest Vulnerabilities, Not the Riskiest Ones
    Description
    We sort vulnerabilities mostly by external security context (CVSS, Threat Intel) on CVEs. This means we patch high-severity vulnerabilities on isolated test servers while leaving "medium risk" on our internet-facing payment database because it says "not urgent" on our list. We're measuring vulnerability magnitude, not actual risk to the business.
    Cost of inaction
    Remediation effort is misaligned with actual risk. High-impact assets get deprioritized. Non-CVE risks like identity attacks are not stack ranked. Attackers exploit business-critical systems we never got to because they had lower severity scores.

    Remediation Workflow

    Your gap

    What's happening
    Remediation Tickets Lack Context, ownership, and We Don't Verify Fixes Actually Work
    Description
    Tickets sent to IT teams contain vulnerability details and hostnames. Teams spend time researching who owns the asset, why it matters, and what the remediation options are. When the patch deploys, we check it off : but don't verify the risk actually decreased. Patches fail. Compensating controls drift. We don't know.
    Cost of inaction
    Analyst time wasted on ticket triage instead of strategy. Remediation SLAs met but risk remains. Patches that fail go undetected. False confidence about our actual exposure posture.

    Reporting & Metrics

    Your gap

    What's happening
    Our metrics are vanity (not necessarily relate to real risk)
    Description
    We report 95% patch rate. We don't mention that the 5% we missed includes our most critical, most exposed systems. We track patch count, not risk reduction. Our board sees busy-ness metrics but can't assess whether we're actually getting safer.
    Cost of inaction
    Executives can't make informed security investment decisions. We can't demonstrate program ROI. Competing investments for budget because we can't show actual value in business terms.

    Continuous Improvement

    Your gap

    What's happening
    We're Manually Remediating the Same Classes of Issues, Repeatedly
    Description
    Every quarter we find unmanaged assets without EDR, user accounts without MFA, cloud resources without security tags. Each one becomes a ticket. We're not learning. We're not automating. We're just creating more work.
    Cost of inaction
    Analyst burnout from repetitive work. Exposure patterns never prevented : only repeatedly remediated. Automation potential untapped. Team velocity capped at manual ticket volume.

    What should the presentation lead with?

    1. Lead with dimensions, not tools. Avoid "our Nessus doesn't talk to our CloudSploit." Instead: "We don't have a unified view across scanner, EDR, cloud, and identity."
    2. Connect to cost. Every gap has a cost: analyst time, missed risks, or misaligned remediation effort. Quantify if you can.
    3. Propose a path, not a product. Don't say "We need Axonius." Say "We need unified inventory with automated asset enrichment and continuous discovery."
    4. Reference your assessment results. This assessment gives evidence. Use it. "Our assessment shows we're at Level 2 in four dimensions : here's the improvement path."

    What are the four maturity levels?

    Each answer scores 2 for A, 1 for B, and 0 for C, so the 18 answers add up to a total from 0 to 36, and the total sets the level.

    1. Level 1: Siloed

      0–12 points

      Tool-centric, reactive. Independent scanners. CVSS-driven prioritization. Effort-based metrics.

      Vulnerability management is tool-centric and reactive. Scanners and tools operate independently. Prioritization is CVSS-driven. Metrics measure effort, not risk reduction.

      Your level

    2. Level 2: Emerging

      13–23 points

      Some integration. Basic asset context. Manual business adjustments. Activity-aware metrics.

      Some tool integration exists. Basic asset context is available. Prioritization considers some business context. Metrics acknowledge limitations. Automation is minimal.

      Your level

    3. Level 3: Structured

      24–30 points

      Well-integrated tools. Comprehensive visibility. Contextual prioritization. Risk-aligned metrics.

      Tools are well-integrated. Asset visibility is comprehensive. Prioritization is contextual and dynamic. Metrics are risk-aligned. Automation is emerging.

      Your level

    4. Level 4: Continuous

      31–36 points

      Continuous exposure management. Full context layers. Dynamic prioritization. Business-driven decisions.

      Continuous exposure management operates across the full attack surface. All context layers inform prioritization. Risk metrics drive business decisions. Automation is pervasive.

      Your level

    What do the six dimensions measure?

    1. Tool Integration

      Your tools operate in a unified view without information silos

    2. Asset Visibility

      You know what assets you have to secure, regardless of what they are and where they are hosted

    3. Risk Prioritization

      You prioritize security findings by combining security, asset, and business context

    4. Remediation Workflow

      Remediation tickets are mobilized quickly and with full context. Fixes are verified to reduce risk

    5. Reporting & Metrics

      Your metrics measure material risk reduction. aka "No vanity metrics"

    6. Continuous Improvement

      Recurring issues are automated. The process is continuously improved to save time and reduce risk

    How is each dimension rated?

    Each dimension’s 3 answers add up to a score from 0 to 6, which sets its level and how critical its gap is. A dimension below 6 has a gap.

    ScoreLevelGap criticality
    0 to 2Level 1: SiloedCritical
    3 to 4Level 2: AwareHigh
    5 to 6Level 3: IntegratedMed/Low

    How does Axonius close these gaps?

    From Silo to CTEM, fast!

    With Axonius, most organizations move from Level 1/2 to Level 3/4 capabilities in weeks, not years. Axonius provides the unified asset intelligence platform that makes this acceleration possible : single source of truth for all assets and security findings, risk prioritization fully aligned to your business, and action for 40+ types of assets. From ground to cloud.

    Request a personalized demo

    Tool Integration

    Your gap

    How Axonius addresses this
    Single unified inventory of assets and security findings with automated data ingestion from all major tools (scanner, EDR, CMDB, cloud, identity). Built-in conflict resolution and data reconciliation logic.
    What's happening
    One source of truth. Analysts work from a single place. Tool disagreements resolved automatically. Time spent on data validation drops 80%.

    Asset Visibility

    Your gap

    How Axonius addresses this
    Continuous discovery across all asset types: managed endpoints, unmanaged devices, cloud resources, containers, SaaS apps, OT/IoT. Identity correlation reveals who has access to what.
    What's happening
    Complete inventory including shadow IT and ephemeral assets. Discovery updates in hours, not weeks. Asset and security findings automatically contextualized with ownership, criticality, and business classification.

    Risk Prioritization

    Your gap

    How Axonius addresses this
    Integrated risk scoring engine combining Security Context (CVE, threat intel, exploitability), Asset Context (posture, criticality, connectivity), and Business Context (data sensitivity, compliance scope).
    What's happening
    Risk scores reflect YOUR business, not just external factors (CVSS, Threat Intel). Prioritization updates continuously as assets, configurations, and threat landscape change. Remediation focus shifts from loud to critical.

    Remediation Workflow

    Your gap

    How Axonius addresses this
    Automated ticket enrichment, integration with ticketing systems (Jira, ServiceNow, PagerDuty, and much more), and closed-loop verification. Workflows coordinate across security, IT, DevOps, and cloud teams.
    What's happening
    Remediation tickets auto-populate with context. Teams get context without investigation. Verification is automatic. Cross-team SLAs are unified and visible.

    Reporting & Metrics

    Your gap

    How Axonius addresses this
    Risk-weighted exposure metrics, trend analysis, and business-contextualized reporting. Connect security improvements to business outcomes and regulatory compliance.
    What's happening
    Reports show risk reduction, not patch count. Executives see exposure trends by business unit and asset category. ROI becomes quantifiable.

    Continuous Improvement

    Your gap

    How Axonius addresses this
    Workflow orchestration platform for automation rules (enforcement, remediation, escalation). Recurring pattern detection converts manual remediation into automated prevention.
    What's happening
    Security team creates automation rules directly. Recurring gaps are auto-prevented. Analyst time shifts from tickets to strategy. Automation coverage grows with program maturity.