Design Partner Program
IMPLEMENTATION GUIDE · CTEM

CTEM guide: run your first exposure management cycle in 90 days.

Continuous Threat Exposure Management is easy to describe and hard to run. This guide is the practical part: what each stage must produce, how to assess where you are, a 90-day rollout, and the metrics that show it's working.

ONE CYCLE · FIVE OUTPUTSthen repeat
01
Scoping Agreed scope tied to business services
Common
02
Discovery Unified inventory of assets and exposures
Common
03
Prioritization Ranked list with context
Common
04
Validation Proof of what's exploitable
Often missing
05
Mobilization Owned fixes, retested and closed
Often missing
Most programs produce the first three outputs. CTEM only pays off when the last two exist.
01 · STAGES AND OUTPUTS

The Five CTEM Stages and What Each Must Produce

A stage is done when its output exists, not when its tool is deployed. Use this as the definition of done for every cycle.

STAGE QUESTION IT ANSWERS OUTPUT (DEFINITION OF DONE) OWNER
01

Scoping

Which parts of the business matter most right now? Two or three named scopes, each tied to a business service and an executive owner. Security lead + business owners
02

Discovery

What do we have, and what's exposed? One inventory of assets, vulnerabilities, misconfigurations and identity exposures for each scope. Exposure / VM team
03

Prioritization

Which exposures would matter most if exploited? A ranked list combining exploitability, threat intel and asset criticality. Exposure / VM team
04

Validation

Can an attacker actually exploit this here? Each top priority proven exploitable or not, with evidence and the attack path. Offensive security
05

Mobilization

Who fixes it, by when, and is it really fixed? Validated findings routed to owners with SLAs; every fix retested before closure. Engineering + IT, tracked by security
02 · SELF-ASSESSMENT

CTEM Maturity Assessment: Where Does Your Program Stand?

Pick the statement that best describes each stage today. Your weakest stage is where the next cycle should focus.

01Scoping

Scopes tied to critical services, reviewed each cycle.

02Discovery

Inventory updates continuously, including shadow assets.

03Prioritization

Threat intel, exploitability and business context combined.

04Validation

Annual pentest checks a sample.

05Mobilization

Owners assigned, no SLA or retest.
YOUR PROFILE
Scoping 3
Discovery 4
Prioritization 3
Validation 2
Mobilization 2
OVERALL Repeatable · 2.8 / 4
FOCUS NEXT ON Validation Prove which top priorities are exploitable before they reach engineering. This is where most programs stall.

A self-check, not a benchmark. Levels are a simplified model for planning.

03 · ONE CYCLE, END TO END

A CTEM Cycle in Practice: From 18,400 Findings to 21 Proven Fixes

One scope, one cycle. Watch how each stage narrows the work, and why validation is the step that turns a priority list into something engineering will act on.

Illustrative cycle · synthetic numbers · 20 s replay

Scope: customer-facing payments cycle 01 · 6 weeks
Not started
DISCOVERED ··
IN SCOPE ··
PRIORITIZED ··
VALIDATED ··
ROUTED ··
FIXED & RETESTED ··
Press play to follow one cycle. Bars use a log scale so every stage stays visible.
00:00 / 00:20
04 · THE 90-DAY ROLLOUT

How to Implement CTEM: A 90-Day Plan

Start narrow. One business-critical scope, run through every stage once, beats five scopes stuck in discovery.

DAYS 0 TO 30

Scope and baseline

→Pick one business-critical scope with its owner→List the assets and data that support it→Connect existing scanners to one inventory→Agree severity SLAs with engineering
EXIT CRITERIA A written scope, a single inventory and agreed SLAs.
DAYS 31 TO 60

Prioritize and validate

→Rank exposures with exploitability and business context→Validate the top priorities in the scoped environment→Record evidence and attack paths for each→Drop or downgrade what's proven not exploitable
EXIT CRITERIA A validated top-priority list engineering agrees is real.
DAYS 61 TO 90

Mobilize and report

→Route validated findings to named owners→Retest each fix before closing it→Report stage metrics to leadership→Choose the next scope and repeat
EXIT CRITERIA Fixes proven closed, metrics reported, cycle 02 scoped.
05 · METRICS

CTEM Metrics That Show Progress, and the Ones That Don't

Report outcomes per stage to leadership. Volume metrics go up as discovery improves, which makes them look like failure.

STAGE TRACK THIS NOT THIS

Scoping

Share of critical business services with an agreed scope and owner. Number of assets in scope.

Discovery

Coverage of the scope's assets across external, cloud, identity and apps. Total findings discovered.

Prioritization

Share of top priorities later validated as exploitable. Count of critical CVSS findings.

Validation

Time from priority to proof, and share of priorities validated. Number of tests run.

Mobilization

Mean time to validated fix, and regressions caught by retest. Tickets opened.
06 · TOOLING MAP

CTEM Tools by Stage: What You Probably Already Own

CTEM is a program, not a product. Most of the stack exists already; the common gap is validation and the hand-off into mobilization.

TOOL CATEGORY
Scope
Discover
Prioritize
Validate
Mobilize
CMDB and business service maps Asset ownership, criticality
External attack surface management Internet-facing discovery
Vulnerability management Host, container and app scanners
Cloud and identity posture CSPM, CIEM, ITDR
Exposure aggregation / CAASM Unified inventory and risk scoring
Threat intelligence Known exploited vulnerabilities, actor TTPs
Adversarial exposure validation BAS, automated attack paths, governed testing
Penetration testing and red team Human-led, periodic
Ticketing, SOAR and CI/CD Routing, SLAs, fix verification
Primary role Supporting role
07 · WHERE HAYROK FITS

Validation and Mobilization, Governed and Continuous

Hayrok takes the prioritized exposures your existing tools produce, proves which are exploitable in your environment, and hands engineering a validated finding with evidence. When the fix ships, it retests and closes the loop.

01

Takes your priorities as input

Ingests findings from the scanners and posture tools you already run, per scope.

02

Validates in your environment

HIVE Agents reproduce attack paths under approved limits to prove what's exploitable.

03

Scores what's proven

The Risk Engine scores validated exposures 0 to 100 using real reachability and impact.

04

Routes with evidence

Validated findings go to owners with the attack path and replayable proof attached.

05

Retests to close

Each fix is revalidated automatically; Evidence Fabric records the outcome.

08 · FAQ

CTEM Implementation FAQ

A first full cycle on one scope can run in about 90 days if you use tools you already own for discovery and prioritization. Broad, organization-wide CTEM takes longer and grows one scope at a time.

YOUR FIRST CYCLE

Pick one scope. Run all five stages. See what's actually exploitable.

Bring your current priority list for one business-critical scope. We'll validate it, show you which exposures are real and hand you a mobilization-ready backlog with evidence.