Platform · CTEM
Your exposure surface, seen continuously.
Sentrix runs continuous threat exposure management (CTEM) across six domains, from applications to the internal network, next to compliance and vendor risk.
Continuous threat exposure management (CTEM) is a cycle in five stages, scoping, discovery, prioritization, validation and mobilization, that keeps an organization's exposure to threats under control between audits and between incidents. Sentrix applies it across six exposure domains, from web applications to the internal network: it discovers what is exposed, prioritizes what matters and sends the fixes back where your teams work.
What CTEM is
The SANS Institute, in a white paper published on July 16, 2024, sets the frame: CTEM is built on five core process steps, and it succeeds only when treated as an ongoing organizational discipline. It does not replace attack surface management or vulnerability management. It builds on them and adds what they lack: a scope defined by business value, validation of what is really exploitable, and the mobilization of the teams that fix.
| Stage | What it answers |
|---|---|
| Scoping | Which systems, data and business processes matter most? |
| Discovery | What is exposed: assets, flaws, misconfigurations, identities, third parties? |
| Prioritization | Which exposures lead to real impact, given attack paths and active threats? |
| Validation | Is the exposure actually exploitable, and would the controls stop it? |
| Mobilization | Who fixes it, by when, and how is it tracked to closure? |
The Cloud Security Alliance, in a post dated May 24, 2024, describes mobilization as the stage where remediation tasks are assigned and resources allocated, with IT, security and business teams working together.
Six exposure domains, one view
Sentrix gathers discovery and telemetry from each domain and returns prioritization and remediation to it.
| Domain | What Sentrix discovers |
|---|---|
| Application | Web applications, exposed APIs, secrets in code, vulnerable dependencies, critical flaws, exposed test environments |
| Cloud and SaaS | Cloud accounts, risky configurations, public buckets, SaaS applications, unmanaged SaaS, unapproved AI tools |
| Assets | Domains, IP addresses, open ports, certificates to renew, end-of-life services, dangling subdomains |
| Identity | Accounts, privileged accounts, accounts without MFA, non-human identities, AI agents, leaked credentials |
| Supply chain | Vendors, critical vendors, pending assessments, vendor incidents, third-party packages, third-party OAuth apps |
| Internal | Workstations, servers, overdue patches, IoT and OT devices, open shares, endpoints without EDR |
Exposure, compliance and vendor risk on one record
Most organizations run exposure management in one tool, compliance in another and vendor risk in a third, and reconcile them by hand before every audit. In Sentrix they share one record.
- Supply chain exposures are the vendors of the third-party risk register: a pending assessment or a vendor incident is tracked once.
- Remediation is evidence: a closed exposure is recorded where the auditor of your compliance program reads it, mapped to the controls of the 19 frameworks you follow.
- Fixes go back where you work, assigned to an owner and followed to closure, instead of a report that waits for the next meeting.
Built for MSPs and MSSPs too
A managed service provider sees every client, every asset and every exposure in one view, with multi-tenant administration and white-label reporting. See MSPs and MSSPs.
Go further
- CTEM, the five stages explained, with what each source says.
- The monthly threat report: ransomware claims, groups active in Canada and new entries in the CISA KEV catalog.
Sources
- SANS Institute, Advancing Cybersecurity with Continuous Threat Exposure Management (Jonathan Risto, July 16, 2024)
- SANS Institute, Introducing the CTEM Maturity Model (Jonathan Risto, July 22, 2025)
- Cloud Security Alliance, The Transformative Power of Continuous Threat Exposure Management: Myth or Reality? (May 24, 2024)
Frequently asked questions
- What is continuous threat exposure management (CTEM)?
- CTEM is a continuous cycle for reducing exposure to threats. The SANS Institute describes it as five process steps: scoping, discovery, prioritization, validation and mobilization. It covers more than software flaws: misconfigurations, identities, third parties and exposed assets are part of the same cycle.
- How is CTEM different from vulnerability management?
- Vulnerability management is one input of the discovery stage. CTEM adds scoping by business value upstream, validation downstream, and mobilization of the teams that fix things. The SANS Institute sums it up: it is not about scanning more often.
- What does Sentrix monitor?
- Six exposure domains: applications, cloud and SaaS, assets, identity, supply chain and the internal network. Examples: exposed APIs and secrets in code, public buckets and unapproved AI tools, open ports and certificates to renew, privileged accounts without MFA, critical vendors and third-party OAuth apps, overdue patches and endpoints without EDR.
- Why run CTEM and compliance in the same platform?
- Because the same facts serve both. A vendor with a pending assessment is an exposure and a third-party risk finding; an overdue patch is an exposure and evidence for vulnerability management controls such as ISO/IEC 27001:2022 Annex A 8.8. Sentrix keeps one record for the security team and the auditor.
- Can an MSP or MSSP run CTEM for several clients?
- Yes. Partner licenses manage multiple client environments from a single pane, with multi-tenant administration and white-label reporting. Each client keeps its own exposure view, compliance program and vendor register.
Related pages
Platform · Compliance
Configure a control once. Satisfy every framework.
Sentrix maps each control to every framework you follow, collects evidence automatically from your real stack and keeps it current, so you stay audit-ready.
Platform · Third-party risk
Know your vendor risk before your auditor does.
Sentrix gives you continuous visibility into every vendor's risk posture, not a point-in-time questionnaire that is already stale the day after you send it.
Solutions · MSPs and MSSPs
Every client, every asset, every exposure. One view.
For MSPs and MSSPs: each client's compliance, exposure and vendor risk in one multi-tenant platform, with white-label reports, in French and English.
Analysis · Exposure
CTEM: the five stages explained
Scoping, discovery, prioritization, validation, mobilization: what each stage of the CTEM cycle produces, and what sets it apart from vulnerability management.
Let's talk about your compliance program.
Last updated: