Exposure Management & Attack Surface

Exposure management is the discipline of continuously discovering, prioritizing, and validating what an attacker can actually reach in your environment — not just what's vulnerable in CVE counts. Gartner coined Continuous Threat Exposure Management (CTEM) in 2022 to capture the operational shift: vulnerability scanning produced unactionable backlogs because it answered 'what's vulnerable?' when the question that mattered was 'what's exploitable, exposed, and worth fixing first?'

The field splits into three adjacent product categories. External Attack Surface Management (EASM) — Censys, Tenable ASM, Microsoft Defender EASM — discovers and assesses internet-facing assets from an outside-in perspective, the way an attacker would. Cyber Asset Attack Surface Management (CAASM) — JupiterOne, Axonius, runZero — aggregates internal and external asset inventory across existing tools (EDR, MDM, cloud APIs, ticketing) and produces a unified asset graph. Breach and Attack Simulation (BAS) — SafeBreach, Cymulate, AttackIQ — and attack-path analysis (XM Cyber, CyCognito) validate which exposures are actually reachable through the network and identity graph.

The CTEM lifecycle has five stages — Scoping, Discovery, Prioritization, Validation, Mobilization — and Validation is the step that distinguishes mature programs. A team that validates exposures via simulated attacks knows which 100 of their 50,000 vulnerabilities matter; a team that ranks by CVSS alone is guessing. Reachability-aware vulnerability management has become the operational endpoint of this field, and the legacy vuln-scanner vendors (Tenable, Qualys, Rapid7) have all extended into CTEM-adjacent capabilities to keep up.