CTEM vendors: who they are, what they sell and how CISOs compare them

On CISO Tribune's record as of 18 October 2026, 12 vendors file under exposure prioritisation and continuous threat exposure management (CTEM). Between them, their products pull findings from scanners, cloud and identity tools, rank the exposures an attacker could use, test whether attacks would work and route fixes to owners. Chief information security officers (CISOs) compare them on asset coverage, where prioritization data comes from, validation method, fix routing and board reporting.

Key facts

• Our record files 12 vendors under CTEM: six as their primary category and six as a secondary one (category record).
• Gartner describes CTEM as a way to "continually evaluate the accessibility, exposure and exploitability of digital and physical assets" (Gartner, 22 February 2024).
• Gartner forecast on 16 October 2023 that organizations basing security investment on a CTEM program would cut breaches by two-thirds by 2026 (Gartner).
• The Cybersecurity and Infrastructure Security Agency (CISA) listed 1,748 entries in its Known Exploited Vulnerabilities (KEV) catalog after its 16 October 2026 update (CISA).
• Since 10 June 2026, Binding Operational Directive (BOD) 26-04 sets federal patch urgency from asset exposure, KEV status, exploit automation and technical impact (CISA).
• The Exploit Prediction Scoring System (EPSS) from the Forum of Incident Response and Security Teams (FIRST) estimates the chance that a published Common Vulnerabilities and Exposures (CVE) entry is exploited in the next 30 days (FIRST).
• Since 15 April 2026, the National Vulnerability Database (NVD) run by the National Institute of Standards and Technology (NIST) prioritizes KEV entries, federal software and critical software for enrichment and marks other CVEs "Lowest Priority" (NIST).

What CTEM vendors sell: the definition and the five stages

CTEM is Gartner's term for a program, not a product. A Gartner research summary dated 30 June 2025 calls it "a process-oriented Gartner framework" for buyers to find where they carry risk (Gartner). Vendors sell software or services that run parts of it.

Gartner's 16 October 2023 strategic trends release defined CTEM as a pragmatic, systemic approach for evaluating the accessibility, exposure and exploitability of an enterprise's digital and physical assets, continually and consistently (Gartner). It added that scoping assessment and remediation by threat vector or business project, not by infrastructure component, surfaces unpatchable threats as well as vulnerabilities.

The program runs as five repeating stages: scoping, discovery, prioritization, validation and mobilization. The public Gartner article that set out all five on one page now redirects to Gartner's cybersecurity home page (we checked on 18 October 2026), so we describe each stage only in wording Gartner still publishes:

• Scoping. Set scope by threat vector or business project, as in the release above.
• Discovery. Gartner's definition of exposure assessment platforms, with mandatory features updated in November 2025, expects discovery across internal, external, cloud and end-user attack surfaces, from endpoints and identities to Internet of Things (IoT), operational technology (OT) and cloud applications (Gartner Peer Insights).
• Prioritization. The same definition ranks issues by accessibility, visibility and exploitability, applying asset, threat intelligence and security control context.
• Validation. Gartner's 12 April 2023 trends release described cybersecurity validation as the techniques, processes and tools that confirm how attackers would exploit an identified exposure (Gartner).
• Mobilization. The exposure assessment definition asks products to "enable mobilization by integrating into a wider set of IT service management systems".

CTEM sits on top of four sibling categories in our taxonomy. Vulnerability management scans for known flaws and misconfigurations and tracks remediation, which feeds discovery. External attack surface management finds internet-facing assets from the outside, and cyber asset inventory (CAASM) builds an inventory from existing tools; both serve scoping and discovery. Breach simulation and automated pen-testing emulates attacker techniques against live environments, which is the validation stage.

Our taxonomy defines the CTEM category itself as platforms that unify findings across scanners and apply context to decide which exposures to fix first, as part of a continuous programme. Out of scope: bug bounty programs (crowdsourced testing), brand and dark web monitoring (digital risk protection), and detection tools that never rank exposures before an attack.

What CISA, NIST, FIRST and the EU say about exposure prioritization

Our read: no regulator requires CTEM by name. What exists are public scoring inputs and remediation rules that CTEM products consume or should be measured against.

CISA BOD 26-04. Issued on 10 June 2026, it binds federal civilian agencies and sets remediation urgency from four questions: is the asset publicly exposed, is the flaw in the KEV catalog, can an adversary automate exploitation, and does exploitation give partial or total control (CISA). Where its timetable calls for it, agencies must remediate within three days and run a forensic triage to check whether the asset is already compromised. Agencies must also tag every externally reachable asset with organization, environment, exposure and asset type.

BOD 26-04 replaced BOD 22-01 of 3 November 2021, which had set two weeks for KEV entries with CVE IDs from 2021 onward and six months for older ones (CISA). CISA adds a KEV entry only when a flaw has a CVE ID, reliable evidence of active exploitation and a clear remediation action. It says the catalog should inform prioritization but not be the only factor.

EPSS and CVSS. They answer different questions. EPSS gives every CVE a daily exploitation probability. FIRST's own answers page says "EPSS is not a complete risk score" and notes that the KEV catalog covers roughly 0.5% of published CVEs (FIRST). The Common Vulnerability Scoring System (CVSS), whose version 4.0 was first released in November 2023, scores severity (FIRST). Its specification leaves the Threat and Environmental metrics to the consumer and notes that providers such as NVD typically publish only base scores (FIRST).

NIST. NIST Special Publication 800-40 Revision 4 (April 2022) defines enterprise patch management as identifying, prioritizing, acquiring, installing and verifying patches, and frames it as preventive maintenance (NIST). The Cybersecurity Framework (CSF) 2.0 of 26 February 2024 lists outcomes a CTEM program should evidence: assets prioritized by criticality (ID.AM-05), vulnerabilities "identified, validated, and recorded" (ID.RA-01), risk responses chosen, prioritized, tracked and communicated (ID.RA-06), improvements drawn from security tests (ID.IM-02), and risk management performance evaluated and reviewed (GV.OV-03) (NIST).

The EU NIS2 Directive. Directive (EU) 2022/2555, applied by member states from 18 October 2024, requires essential and important entities to cover vulnerability handling and disclosure, and to keep procedures for assessing whether their risk-management measures work, under Article 21(2)(e) and (f) (EUR-Lex). Article 20 requires management bodies to approve those measures and oversee their implementation.

MITRE ATT&CK. MITRE describes it as a public knowledge base of adversary tactics and techniques drawn from real-world observation (MITRE). Filigran's OpenAEV, on our record, builds its scenarios on it, and a technique coverage list is the plainest way to compare validation depth.

Gartner's forecasts, in its own words. On 12 April 2023 Gartner predicted that by 2026 organizations prioritizing security investment on a CTEM program would "suffer two-thirds fewer breaches" (Gartner). Its 16 October 2023 release said such organizations "will realize a two-thirds reduction in breaches", and its 22 February 2024 release repeated that sentence. The April 2023 release also forecast that through 2026 more than 40% of organizations, including two-thirds of midsize enterprises, would rely on consolidated platforms for validation. Our read: 2026 is the target year and we found no Gartner release reporting a measured result, so treat both as forecasts.

Who the CTEM vendors are

On CISO Tribune's record as of 18 October 2026, 12 vendors file under exposure prioritisation and CTEM (category record). Six list it as their primary category. Six carry it as a secondary category beside a main one: threat intelligence (three), and managed security services, managed detection and response, and cyber risk quantification (one each).

Ownership: none is publicly traded, one is owned by a parent (XM Cyber, part of Schwarz Group since 2021), two are private, and the record does not yet state ownership for the other nine. Headquarters: two in the United States, one each in Canada, Israel and Sweden, and seven not yet recorded.

What they share: each takes findings from scanners, cloud and identity tools or threat feeds and decides which exposures matter in one environment. They differ in where they start.

Some start from tools already in place. Nagomi Security maps an organization's existing security tools against relevant threats and issues remediation plans. Outpost24 pairs its own external attack surface management and risk-based vulnerability management with an exposure management platform.

Some start from validation. AttackIQ tests whether controls detect and stop adversary techniques and links findings into attack paths. XM Cyber maps and validates attack paths across on-premises and cloud networks, and Filigran offers OpenAEV, which emulates attack scenarios based on MITRE ATT&CK, beside its OpenCTI threat intelligence platform.

Some start from the fix. Seemplicity assigns remediation to owners and tracks it through existing workflows. Tamnoon is a managed service that investigates findings from cloud-native application protection (CNAPP) and endpoint detection and response (EDR) tools in read-only mode, then runs validated fixes through the customer's own change process.

The rest start from intelligence, risk or services. Dataminr correlates threat intelligence with control performance and states exposures in financial terms; Intel 471 sells a threat intelligence platform with a cyber threat exposure product line; Safe Security sells artificial intelligence agents built to work across the CTEM phases. Cyderes and eSentire sell exposure work as managed services beside detection and response; eSentire's Atlas Preempt continuously tests attack paths.

The full list is on this page below the guide, alphabetical within each category.

How CISOs compare CTEM vendors

Where the product starts. An aggregator depends on the scanners you already run, a scanner-native platform sees its own data best, and a validation-first tool proves exploitability but may not hold your inventory. We think the deciding question is which stage your program fails at now.

Provenance of every score. Since 15 April 2026, NVD no longer routinely adds its own severity score where the CVE Numbering Authority supplied one, and it marks CVEs outside its priority criteria as not scheduled for immediate enrichment (NIST). Ask each vendor whose CVSS score it displays, which EPSS model it uses and how quickly a new KEV entry changes a ranking.

Validation in production. Simulation and automated testing run against live systems. Ask what the product executes, how a test is stopped, which ATT&CK techniques it covers and whether results feed the improvement records CSF 2.0 expects under ID.IM-02.

Mobilization and reporting. Our read: programs stall at the handoff to the teams that patch, and the four tags BOD 26-04 requires, organization, environment, exposure and asset type, are a workable minimum ownership model. For the board, ask for trend metrics built from exportable data, such as validated exposures open past target and time to fix KEV entries. NIS2 Article 20 gives oversight to the management body.

What a proof of concept should test

• Coverage: load one scoped business service and reconcile discovered assets against your inventory.
• Ranking: pick ten findings and trace each rank back to its raw inputs and their sources.
• Freshness: note when a new KEV entry lands and how long the product takes to re-rank affected assets.
• Validation: run tests in a non-production clone, then one approved production test.
• Routing: send 20 findings through your IT service management tool and count how many reach the right owner untouched.
• Exit: export findings, history and metrics, then rebuild one board chart outside the product.

What changed for CTEM vendors in 2025 and 2026

• 7 February 2025. Tenable closed its acquisition of Vulcan Cyber, saying the deal would add visibility, prioritization and remediation capabilities to its exposure management platform (Tenable).
• 21 October 2025. Dataminr announced its intent to acquire ThreatConnect, an intelligence management platform, in a transaction valuing ThreatConnect at $290 million (Dataminr).
• November 2025. Gartner updated the mandatory features of its exposure assessment platform definition, covering prioritization, discovery and mobilization.
• 15 April 2026. NIST moved the NVD to risk-based enrichment after CVE submissions rose 263% between 2020 and 2025, with a goal of enriching KEV entries within one business day.
• 10 June 2026. CISA issued BOD 26-04 and revoked BOD 22-01 and BOD 19-02, so federal patching now targets the highest risks rather than treating all vulnerabilities alike.
• Through 16 October 2026. CISA added 264 entries to the KEV catalog in 2026, after 245 in 2025, by our count of its machine-readable feed.

Related reading

For board and investor reporting, see the Securities and Exchange Commission (SEC) disclosure rules for CISOs, the Item 1.05 materiality guide and the 10-K governance statements in our disclosures record. For who CISOs report to, read reporting lines and the 10-K reporting-lines guide; terms are in the glossary and the role in what a CISO does.