The Five Stages of CTEM: How ASM, PTaaS, and AEV Map to Gartner’s Framework

Summary

• Gartner’s Continuous Threat Exposure Management (CTEM) framework defines five stages: Scoping, Discovery, Prioritization, Validation, and Mobilization.
• The framework describes the goals of each stage, not the tools that execute them.
• Attack Surface Management (ASM) handles Scoping and Discovery by mapping the attack surface and surfacing exposures.
• Adversarial Exposure Validation (AEV) and continuous pentesting drive Prioritization, Validation, and Mobilization by testing which exposures are actually exploitable.
• Running all three solutions together turns CTEM from a concept into an operational proactive security program.

Key Terms

• Continuous Threat Exposure Management (CTEM): A Gartner-defined framework for continuously identifying, prioritizing, validating, and mitigating security exposures.
• Attack Surface Management (ASM): Continuous discovery and inventory of an organization’s internal and external assets and attacker entry points.
• Adversarial Exposure Validation (AEV): Automated simulation of attacker behavior to determine which exposures are actually exploitable.
• Penetration Testing as a Service (PTaaS): A continuous, platform-delivered model for penetration testing that combines automation with human-led analysis.
• Exploitability: The likelihood that a given vulnerability can be practically exploited by an attacker, as opposed to its theoretical severity.

5 Stages of CTEM

Point-in-time pentests and static vulnerability scanning give teams a snapshot of their environment. The problem is that the attack surface doesn’t hold still long enough for a snapshot to stay accurate. New assets are spun up, configurations drift, and new exposures open between one test and the next.

Gartner introduced Continuous Threat Exposure Management to close that gap, making the case that security teams need an ongoing cycle of discovery and validation rather than a periodic check-in. It’s part of why CTEM has moved from an analyst concept to something showing up in actual security roadmaps. It names a problem practitioners were already feeling and gives them a structure to act on it.

Gartner’s CTEM framework defines five stages: Scoping, Discovery, Prioritization, Validation, and Mobilization. What it doesn’t specify is which tool or testing process does the work at each stage. That’s the information security teams need to fill in, and it’s where ASM, continuous pentesting, and AEV earn their place.

Each of these three capabilities maps to specific stages of the CTEM lifecycle. Understanding this alignment serves as a practical CTEM program implementation guide, turning a high-level framework on a slide into an operational security program that actually reduces risk.

CTEM Stage 1: Scoping with ASM

Scoping sets the foundation for the entire CTEM program. This is where security teams identify the business-critical assets that carry the greatest attack risk.

The goal isn’t a complete inventory of the IT environment. It’s identifying which assets should be prioritized for remediation based on what the business stands to lose if they’re compromised. During scoping, teams work out:

• Which threats are most relevant to the business
• Forecast which assets would take the biggest hit if a given threat succeeded
• Define the metrics that will show whether the CTEM program is working

ASM makes this possible by giving defenders continuous visibility into the attack surface. BreachLock ASM identifies and inventories exposed assets and attacker entry points in real time, giving teams a defensible basis for scoping decisions. From there, teams move into the remaining four stages to uncover, rank, and remediate exposures.

CTEM Stage 2: Discovery with ASM

Discovery is where teams identify the actual security issues within the assets scoped in Stage 1. This means reviewing those assets against the risks they’re exposed to, including misconfigurations, shadow IT, weak credentials, and similar gaps.

ASM solutions continuously scan the attack surface to produce a real-time inventory of every asset and exposure, known and unknown. That inventory answers the questions that matter most at this stage: which in-scope assets are internet-facing, what vulnerabilities exist across them, and what else needs immediate attention.

The result is a real-time view of risk that gives defenders something traditional point-in-time scans can’t: the ability to see where security gaps exist right now and act on evidence rather than assumption.

CTEM Stage 3: Prioritization with AEV and Pentesting

CTEM doesn’t push teams to remediate every security gap they find. It pushes them to determine which exposures actually matter, ranked by exploitability, asset value, and available compensating controls rather than CVSS score alone. That threat-centric approach lets teams address the exposures with real impact first, instead of spreading remediation effort thin across a long list of theoretical criticals.

AEV supports the prioritization stage in CTEM by identifying which exposures are real. It simulates attacker behavior and chains vulnerabilities together to surface the paths that pose immediate, exploitable risk, so teams can focus remediation on what an attacker would actually use rather than everything a scanner flagged.

Continuous penetration testing supports this stage the same way, through a unified platform that gives teams a comprehensive, real-time view of the attack surface for risk-based prioritization. That platform also simplifies scaling across teams, regions, or subsidiaries, gives teams shared dashboards for faster decisions, and delivers remediation guidance teams can act on immediately.

CTEM Stage 4: Validation with Continuous Pentesting and Breach360

Exposure validation is where organizations find out whether identified weaknesses can actually be exploited, whether existing controls can stop the threats they’re designed to stop, and whether posture has genuinely improved since the last remediation cycle.

Continuous pentesting combines automated scanning with human-led analysis to sharpen both attack surface visibility and prioritization. Delivered through a unified experience, such as the BreachLock Unified Platform, it can autonomously map the full attack surface, identify vulnerable assets and critical choke points, exploit vulnerabilities, validate complex attack paths, and demonstrate the business impact of exploitation. That combination lets defense teams focus remediation on real threats and move quickly to disrupt attacks in progress.

Breach360, BreachLock’s autonomous penetration testing solution, brings continuous, automated validation to the same stage. Powered by live threat intelligence, Breach360 generates and executes multistep attack scenarios across multiple threat vectors, emulating how real adversaries move, showing what’s exposed in real time, and testing how far an attacker could escalate or pivot. Breach360 also grounds its recommendations in attacker logic rather than CVSS scores, giving teams exposure context they can act on as the environment changes.

CTEM Stage 5: Mobilization with Breach360 and Pentesting

In the final stage of CTEM, cross-functional teams operationalize findings, execute remediation for prioritized threats, and track whether those fixes actually hold up over time.

Breach360 continuously validates the exposures that matter most, cutting through noise so teams can focus on what genuinely needs fixing. That ongoing, adversary-aware validation also speeds up incident response and improves remediation efficiency over time.

Pentesting plays the same role here. Autonomous pentesting platforms keep visibility into the attack surface current, support prioritization based on real threats rather than theoretical ones, and provide remediation guidance teams can act on without translation.

Where ASM, Pentesting, and AEV Fit in CTEM

Mapping CTEM end to end, ASM owns Scoping and Discovery. AEV and continuous pentesting carry Prioritization, Validation, and Mobilization. None of the three replaces the others, and none of them completes a CTEM program alone. The framework only becomes operational when all three run together, continuously.

BreachLock’s suite of human-delivered, AI-powered, and automated security solutions brings ASM, continuous pentesting, PTaaS, and Breach360 together under one CTEM-aligned program, so teams can discover, prioritize, and mitigate real-world exposures continuously rather than piecing the work together across disconnected tools. Over 1,200 organizations in 20+ countries rely on BreachLock to run that program. Book a demo to get started.

FAQs about Pentesting and ASM in the Five Stages of CTEM

What’s the difference between ASM and AEV in a CTEM program?

Attack Surface Management (ASM) continuously discovers and inventories an organization’s exposed assets, while Adversarial Exposure Validation (AEV) simulates attacker behavior to test whether those exposures are actually exploitable. ASM answers the question of what exists and where it’s exposed. AEV answers the question of what an attacker could actually do with it. In a CTEM program, ASM typically drives the earlier Scoping and Discovery stages, and AEV drives Prioritization, Validation, and Mobilization.

Which CTEM stages does attack surface management support?

Attack surface management supports the Scoping and Discovery stages of CTEM. During Scoping, ASM gives defenders continuous visibility into exposed assets and attacker entry points, which teams use to identify what carries the greatest business risk. During Discovery, ASM scans that same attack surface to identify specific security issues, such as misconfigurations, shadow IT, and weak credentials, across the assets already in scope.

Can continuous pentesting and AEV work together in the same CTEM program?

Yes, continuous pentesting and AEV work together across the Prioritization, Validation, and Mobilization stages of CTEM, and most mature programs run both rather than choosing one. Continuous pentesting combines automated scanning with human-led analysis to map the attack surface, exploit vulnerabilities, and validate complex attack paths. AEV adds automated, always-on validation between testing cycles, using live threat intelligence to simulate multistep attacker scenarios as the environment changes.

How do you decide where to start when building out a CTEM program?

Start with the stage where your team has the least visibility, since that gap determines which capability to prioritize first. Teams without a reliable, current inventory of their attack surface should start with ASM to establish Scoping and Discovery. Teams that already have strong asset visibility but struggle to tell which vulnerabilities are actually exploitable should prioritize AEV or continuous pentesting to strengthen Prioritization and Validation.

Author

BreachLock Labs