Nine sources, one score, and the question of what is actually exploitable
Without the module every exposure source stands alone: the CVE hits in the CSAF module, the attack surface findings, the Greenbone vulnerabilities, the pentest findings, the leak site hits. CTEM, described by Gartner in 2022, is not a tool but a programme in five stages: scoping, discovery, prioritisation, validation, mobilisation. The module maps exactly these five. Scopes bundle IT systems by business process, location or system group with criticality; the nightly run reads all sources and materialises the exposures; a score per system, scope and tenant makes the situation comparable; the validation stage evidences what is actually exploitable; sprints mobilise remediation.
A high score without valid evidence is a validation gap. Evidence comes from a pentest retest, the protection test, an EDR check, a virtual patch or manually, each with a validity period. The validation rate measures how much of the situation has actually been checked.
The nightly run writes exposures and scores into tables of its own and closes what has disappeared. The cockpit computes nothing live; daily snapshots carry the history and the trend against the previous day.
An adapter reads only when its module is switched on and its tables exist. Without a single source the discovery stays empty, instead of presenting zeros as safety.
One situation instead of nine lists, with one number per system and evidence of which of them has been checked.
Schedule a no-obligation demo – we will show you the module with your own use cases.
