Continuous threat exposure management (CTEM) is a repeating cycle of five stages: scope, discover, prioritize, validate and mobilize. Four modules run all five for every client you add. Discover maps your client before anything is touched. Remediate ranks every finding by blast radius, the damage it could do, confirms what’s real and sends the fix to your PSA. Validate adds penetration tests by a trusted network of third-party, AI-assisted, human-led testers. Suppliers finds and watches the suppliers behind every client.
The chart shows which module covers each stage. Active checks start only after your client approves.
Five stages of CTEM
Harbor Lending is a fictional client. Choose a stage to jump to it, or pause at any point.
Ranked by blast radius: how much damage a failure there could do to your client.
Module 1 of 4
Before you add a client, the fabric already holds its internet-facing systems, its suppliers and the rules it answers to. Discover turns that into a picture your client can confirm, before any scan touches it.
CTEM stage 1 · Scope
The Research engine maps each company from public sources and keeps it current: its internet-facing systems, its suppliers and the rules it answers to. Most of a new client’s scope is ready within the hour of adding it, and your client confirms what’s theirs. Every fact comes with where and when we found it. Anything we can’t confirm is labeled likely, or thrown out.
1Where we look
2Already mapped · harborlending.example
3What happens next
What Harbor knew about: its domain, hosts and VPN, kept current.
What it didn’t know: a staging site, unlisted suppliers and a known-exploited flaw.
The FTC Safeguards Rule applies, so these become evidence Harbor will need.
What we can’t see is listed first, never hidden.
FirmSeen directly in a source we trust, with its date.
LikelyInferred, and labeled likely until a check or your client confirms it.
Thrown outToo old, or contradicted by a newer source.
Can’t seeKnown to exist, unseen from outside. Listed, never hidden.
CTEM stage 2 · Discover
Within the hour of adding a domain, before any scan, the Research engine shows you the hosts, suppliers and lookalike domains each client knew about next to the ones it didn’t, and any threats already in play.
| What | They knew | Outerwall found |
|---|---|---|
| Domains | 1 | 3 |
| Host names | 12 | 38 |
| Suppliers | 2 | 6 |
| Lookalike domains | 0 | 2 |
| Staff emails in breaches | 0 | 11 |
| Threats in play | 0 | 3 |
0 active checks sent to Harbor so far.
Flagged for you
Module 2 of 4
Remediate puts everything in order: ranked by what an attacker could reach, confirmed on approved assets, and sent to your PSA as tickets that close only when the fix is proven.
CTEM stage 3 · Prioritize
Outerwall ranks every finding by blast radius: how much damage it could do to your client if an attacker used it. A threat already in play moves a finding up. Severity alone never sets the order.
How much damage a finding could do to your client: from one host to the payroll system, or from one supplier to every client that shares it.
A flaw on CISA’s known-exploited list, a supplier’s breach notice or a ransomware mention moves a finding up the list the day it appears.
Every finding says whether it’s confirmed or likely, and coverage shows what we couldn’t see. Likely findings at the top get a confirming check first.
Every rule is tested code, so the same data always gives the same answer. No AI model decides a finding.
CTEM stage 4 · Validate, automated
A likely finding stays labeled likely until a check proves it. On approved assets, non-destructive checks confirm a finding or drop it. Then we trace the path an attacker could take from it, and what that path would reach.
Traced attack path · illustration
Non-destructive checks on approved assets turn a likely finding into a confirmed one, or drop it. A version number alone is never enough.
Findings are joined into the paths an attacker would take, including paths that start at a supplier, and ranked by what they would reach.
With approval, Outerwall reads your client’s Microsoft 365, Entra and Defender. A flaw is checked against the patch state Defender reports and the accounts Entra shows it could reach. Blast radius becomes a measurement: which admins, which devices, which shares.
Penetration tests from the Validate module show how far an attacker could really get. Findings land here as they’re confirmed.
CTEM stage 5 · Mobilize
Each finding is escalated as a ticket in ConnectWise, Autotask, HaloPSA, ServiceNow or Jira, ranked by blast radius: how much damage it could do to your client. Before a ticket closes, we check the fix twice.
Each ticket carries the evidence and a plain-language note for your client.
A supplier’s breach, outage or bankruptcy. A new flaw on CISA’s known-exploited list that matches software a client runs. Staff credentials in a breach or infostealer log. A lookalike domain. A ransomware group naming a client.
New subdomains and addresses, DNS and email records. A change triggers a recheck of only the asset that changed.
Module 3 of 4
Validate brings penetration testing into the same workflow, ordered and tracked inside Outerwall, by your own testers or a trusted network of third-party, AI-assisted, human-led testers. Their findings arrive with everything else.
CTEM stage 4 · Validate, with testers
A tester shows how far an attacker could really get, and fixes are retested free. The findings sit alongside everything else Outerwall has found for your client.
Every engagement follows one methodology aligned to CREST’s, drawing on PTES, NIST SP 800-115, OWASP, OSSTMM and MITRE ATT&CK, whichever tester delivers it. AI handles the repetitive analysis at scale. A certified tester leads every engagement, decides what to try, carries out the exploitation and signs off each finding.
Where your client needs it, an engagement can follow CREST’s Defensible Penetration Test specification, with a written statement of scope and coverage, a timeline of the testing and a formal sign-off by a named, certified tester.
You can also use your own penetration testers. Their findings land in Outerwall the same way, ranked and ticketed with everything else.
One methodologyCREST-aligned
Testers hold certifications such as OSCP, OSEP and CREST CRT.
The map is the starting point, so the scope covers the whole attack surface, including the parts your client forgot. Nothing outside the signed scope is touched.
Each finding is scored with CVSS 4.0, grouped by root cause and sent to your service desk with everything else, instead of waiting for a PDF.
A critical finding is reported the moment it’s found, and exploiting one needs your client’s approval first. Nothing that could take a service down is attempted.
Module 4 of 4
Suppliers runs across every stage. Because the fabric holds your whole book, it sees which suppliers your clients share, and a breach at one reaches every client it touches.
Ask a client for its supplier list and it will forget the ones that matter most: the identity provider, and the security agent that updates itself on every laptop. Suppliers finds them from DNS records, job ads and vendor case studies, ranks them by the damage a failure would do, and watches them.
Because the fabric holds every client you protect, it sees which suppliers they share. When one is breached, every client that depends on it is flagged in one view within hours, with a ticket for each, so you raise it with all of them the same morning.
The suppliers it finds become the proposed supplier register in Predictive GRC, for your client to confirm.
Harbor Lending · supplier register6 found, 2 listed
Found from the traces each supplier leaves, including the four nobody listed.
Gartner set out CTEM in 2022 as a five-stage program to find what matters, rank it, prove what’s real and get it fixed. Outerwall runs all five stages for every client you add, from one view, and the chart at the top of this page shows which module covers each one.
Everything exposure management finds, confirms and fixes becomes evidence. Predictive GRC uses it to draft your client’s supplier register, risk register, controls and evidence packs, keeps them current, and proposes a risk when something in the fabric touches your client.
It works the other way too. What your client’s risk register says matters to the business sets what Discover and Remediate look at first.
A short read: what Outerwall finds on a fictional mortgage broker, step by step.