Summary
- Board expectations have shifted from ‘are you patching?’ to ‘prove we are secure’ — a question traditional vulnerability management cannot answer.
- CVE volumes are overwhelming teams, CVSS scores are increasingly regarded as unreliable indicators of real business risk, and AI is accelerating both vulnerability discovery and exploit development.
- Continuous Threat Exposure Management (CTEM) — named a top trend by Gartner in 2023 — provides a five-step framework: scope, discover, prioritise, validate, and mobilise.
- Automated penetration testing tools that chain exploits and demonstrate actual attack paths are emerging as the practical engine behind CTEM programs.
- Practitioners advise against attempting full CTEM implementation in a single year; starting with one well-executed capability is a more realistic path to traction.
The Question That Changes Everything
For years, security teams fielded board questions about patch rates and vulnerability counts. Those metrics were imperfect, but they were answerable. The conversation has now moved somewhere harder. Boards are beginning to ask whether the organisation is actually secure — and sooner or later that becomes a demand for proof. That demand exposes a structural weakness in how most organisations currently manage vulnerabilities.
Three Faults in the Current Model
The industry has built sophisticated machinery for generating vulnerability data. What it has not built, in most cases, are tools that translate that data into meaningful business risk. Three problems compound each other. First, the volume of CVEs is simply unmanageable at the pace they are being published. Drew Vanover, principal security strategist at Horizon3, points to a recent Microsoft patch cycle that included more than 500 fixes. “Nobody is going to be able to go through, vet, prioritize, and deploy all of those in a way that is truly considered safe,” he says. Second, CVSS scores — the standard severity metric — are of limited use in triage. A US Department of Commerce report published this May described them as highly subjective and dependent on the specific role a system plays within a given organisation’s infrastructure. The same report suggested NIST stop assigning CVSS scores altogether. NIST itself has been contending with a multi-year backlog in its National Vulnerability Database and, according to the source material, effectively declared CVE bankruptcy in April. Third, AI is tightening the timeline. The Cloud Security Alliance now describes an asymmetric vulnerability cycle in which attackers can use AI to discover and exploit weaknesses more quickly — increasingly before patches are even available — while defenders are taking longer to respond.
What CTEM Actually Is
Continuous Threat Exposure Management is a structured approach to understanding which exposures can actually hurt a specific organisation, rather than which ones score highest on a generic severity scale. Gartner formalised the framework in 2023 across five stages: scoping assets by business impact, discovering how they are exposed, prioritising based on real risk, validating exploitability through testing, and mobilising response with a proper remediation plan. The framework is deliberately broader than patching. It asks security teams to consider whether three low-severity vulnerabilities could be chained into a path that causes material harm, not just whether a single critical CVE has been closed.
Automated Penetration Testing as the Practical Engine
The complexity of CTEM creates an automation problem. Horizon3’s NodeZero is one tool designed to address the prioritisation and mobilisation stages specifically. It runs penetration tests across production infrastructure, chains exploits as a real attacker would, pivots based on what it finds, and produces documented attack paths with evidence defenders can follow. The output is deliberately narrowed: a shorter list of exploitable paths rather than a broad catalogue of theoretical risks. Vanover describes the system as deterministic rather than generative — built on an expert system rather than a general-purpose large language model, with generative AI used only for specific bounded tasks such as identifying sensitive data within a storage environment. He draws a distinction with a medical analogy: a general LLM is a GP who knows a little about a lot; what is needed for security triage is a specialist. Critically, the platform supports retesting after remediation. Teams can close a ticket only when the attack path is no longer traversable — a testable, auditable definition of fixed that translates into language a CFO can read. Vanover notes that NodeZero has completed more than 320,000 production tests, including engagements with the NSA and large healthcare organisations.
Running in Production: A Risk Worth Taking
Some CISOs will be cautious about autonomous penetration testing in live environments. Vanover argues that testing against a digital twin is actually less reliable, because environments drift continuously with code pushes, configuration changes, and credential updates. A twin that was accurate yesterday may not reflect today’s attack surface. Horizon3 addresses the concern through production guardrails rather than avoidance — the system can demonstrate ransomware capability, for instance, by installing a remote access tool, creating and encrypting a file, and deleting it, without actually encrypting live data.
Where to Begin
Vanover is direct about implementation expectations. Attempting to roll out a full CTEM program in twelve months is a likely path to failure. A more workable starting point is identifying one specific capability — for example, validating which systems are genuinely reachable from the outside, rather than relying on an asset inventory that may be out of date — and executing it well before expanding scope.
Why it matters
Boards are moving from activity-based questions to outcome-based demands. Security leaders who can only report patch volumes and CVE counts will struggle to answer ‘prove it’ in a risk language the board understands. CTEM reframes the security posture conversation around exploitable exposure and demonstrable remediation — metrics that connect directly to business impact. The asymmetric AI threat cycle described by the Cloud Security Alliance makes the timeline for adopting this kind of rigour shorter, not longer.
What to do now
- Audit whether current vulnerability reporting can demonstrate exploitability and business impact, or only CVE counts and CVSS scores — identify the gap before the board does.
- Begin scoping a CTEM pilot around the assets with the highest business impact rather than attempting a full program rollout in year one.
- Evaluate whether your current toolchain identifies actual attack chains — multi-step exploitation paths — not just isolated vulnerabilities.
- Where automated penetration testing is under consideration, assess production guardrail controls and reference Horizon3’s reported experience across 320,000 production tests as a benchmark for risk conversation.
- Prepare board reporting that shifts from patch activity metrics to outcome metrics: number of exploitable paths reduced, blast radius narrowed, and remediations verified through retesting.
