How to implement CTEM, step by step

What does this guide cover?

It covers Continuous Threat Exposure Management (CTEM), a way to find and reduce cyber risk continuously instead of one crisis at a time.

1. Strong alignment to CTEM

   CTEM provides a robust framework with five steps, principles, and best practices. CTEM is based on real life observations of how organizations should approach risks in a proactive and continuous way. By leveraging CTEM as the main driver, the guide ensures strong alignment to your security and risk goals.

2. No silver bullet

   CTEM is an organization-wide approach. As such, it requires a holistic strategy — inclusive of processes, multiple technologies, and people — to be successful. Solutions like Axonius, while crucial for CTEM, should not be viewed as a silver bullet for success. Technologies that position themselves as a silver bullet should also be viewed with caution as they may introduce gaps in your strategy such as breadth of support (coverage across on-prem, public cloud, and multi-cloud planes), processes, and adequate staffing.

3. Connection to technology

   As companies adopt and invest in CTEM, they need a logical understanding of how technology can be deployed at each step in a beneficial way. Each CTEM step is accompanied by a section on how Axonius can be applied to this area with screenshots and links to relevant features and public documentation.

What is CTEM?

Continuous Threat Exposure Management (CTEM) is a proactive and ongoing approach that aims to identify, assess, and reduce an organization’s exposure to cyber threats.

What is Axonius?

Axonius, as a leader in cyber asset management, delivers visibility and actionability across all digital assets.

1. Axonius Cyber Assets

   Ensure every asset across every system is known, compliant and protected.

2. Axonius Software Assets

   Gain actionable visibility into software usage across the organization.

3. Axonius SaaS Applications

   Inventory your SaaS landscape, mitigate risks, and optimize software spend.

4. Axonius Exposures

   Unify exposure findings, correlate and rank risks, and execute mitigations.

5. Axonius Identities

   Unify all identity artifacts in one place to transform fragmented data into insights.

What problem does each step solve?

Each step has one goal and one hard question to answer.

1. 1

   Step 1: Scoping

   How do you measure the business value of your assets?

   Goal and what makes it hard

   Goal: Gain visibility. Identify all assets across cloud, SaaS, on-prem, and third-party environments to establish total attack surface awareness.

   • Dealing with incomplete and inaccurate asset inventory data
   • Working with unclear mappings between assets and workloads
   • Knowing where to apply value measures in prioritization models

   Read step 1: Scoping
2. 2

   Step 2: Discovery

   How do you assess all exposures in one place?

   Goal and what makes it hard

   Goal: Identify exposures. Map out vulnerabilities, misconfigurations, excessive privileges, and exploitable attack paths across attack surface.

   • Disjointed tools generate a lot of noise: duplicates, false positives, and more
   • Understanding which exposures are exploitable and how, and their risk
   • Often missing relevant context, relationships, and real-time threat intel

   Read step 2: Discovery
3. 3

   Step 3: Prioritization

   How do you apply rigor and consistency amidst urgency?

   Goal and what makes it hard

   Goal: Focus mitigation. Calculate exposure risk by factoring in business impact, exploitability, adversary behavior, and risk scores beyond CVEs/CVSS.

   • Issues and alerts lack business context and exploitability insights
   • Often unclear ownership of the asset, the mitigation, and the result
   • Internal and external SLAs often get in the way of risk-based prioritization

   Read step 3: Prioritization
4. 4

   Step 4: Validation

   How do you know what’s real before it becomes real?

   Goal and what makes it hard

   Goal: Confirm exploitability. Test exposures with simulations, red teaming exercises, and attack path modeling to understand real world impact potential.

   • Simulations are resource intensive and can fall to more pressing matters
   • Full attack chains are often technically difficult to implement
   • Testing can potentially disrupt production environments and teamwork

   Read step 4: Validation
5. 5

   Step 5: Mobilization

   How do you break through issue fatigue to meet capacity?

   Goal and what makes it hard

   Goal: Take action. Transform insights into streamlined remediation workflows coordinated across IT and Security operations teams.

   • Even prioritized issues can be more volume than the team can handle
   • Security and IT teams may still operate in mitigation silos
   • Manual ticket-based remediation has slow lead and response times

   Read step 5: Mobilization

How do you get started with CTEM?

Start in increments: as an organization-wide approach, CTEM requires a holistic strategy — inclusive of processes, technologies, and people — and time to be successful.

1. Start with visibility

   Successful CTEM programs are rooted in accurate and up-to-date view of assets and exposures. On the opposite side, a program without confidence in visibility (and without a clear management of expectations) may create the false sense of safety or mismatch the expectation of stakeholders. By investing in a strong visibility (scoping and discovery), you set the foundation for a successful program.

2. Enable an agile CTEM implementation with quick feedback loops

   By investing in the frequency in which the CTEM process is executed (i.e. running full cycles at least once a day), you reduce your mean time to recognize and fix issues while at the same time creating a quick feedback loop for tests, ideation, continuous improvements, and automation. In other words, you create agility and adaptability with your program, avoiding analysis paralysis.

3. Improve Prioritization, Validation, and Mobilization through repeatable iterations

   With strong visibility and quick feedback loops, you have a strong launchpad for prioritization, validation, and mobilization improvements. These phases can start with your existing policies, and rapidly evolve based on your learnings from each CTEM cycle. Initial cycles and improvements will yield more dramatic impact and results and gradually reach a point of diminishing returns.

4. Look for Proactive/Preemptive actions and Automation opportunities

   While CTEM does not explicitly list preemptive/proactive actions or automations as distinct steps in its process, both are deeply embedded in the CTEM approach. When implementing CTEM, you should take an intentful approach on finding opportunities for implementing these actions.

How do you get started with Axonius?

Connect your adapters first: the Axonius platform is designed and built with architectural principles to help your organization get up and running fast.

1. Scope and Discovery

   By integrating your adapters for assets and exposures, you immediately get immediate benefits of scoping and discovery across your entire attack surface across on-prem, public cloud, and private clouds.

2. Prioritization

   From there, you can leverage risk scores, queries, and insights to prioritize the exposures that matter most.

3. Validation and Mobilization

   Once assets and exposures are prioritized, Axonius customers immediately adopt enforcements, workflows, and case binding for both validation and mobilization. (On average, customers grow these actions in about 90% over the 1st 6 months)

Which sources does the guide cite?

Axonius documentation pages, four public vulnerability resources, and research from Gartner and Forrester.

Which Axonius features serve each step?

Twenty-four features map to the five steps; Queries and External to Internal serve four steps each, more than any other feature.