Loading story…
Cyber asset attack surface management (CAASM) and external attack surface management (EASM) tools are essential for organizations seeking to protect their digital assets from cyber threats. These tools are designed to quantify and minimize the attack surface, which encompasses all corporate resources accessible from the internet, including on-premises applications, cloud-hosted resources, open ports, protocols, and server platforms. By providing visibility into these assets, CAASM and EASM solutions help organizations identify vulnerabilities such as configuration deficiencies or unpatched software that could be exploited by attackers. The effectiveness of these tools relies heavily on comprehensive asset intelligence, which ensures that organizations have an accurate and up-to-date inventory of all assets and their interconnections. Continuous Threat Exposure Management (CTEM) frameworks build upon this foundation by offering a structured approach to risk reduction, moving security postures from reactive to proactive. CTEM involves continuously scoping the attack surface, discovering exposures, prioritizing mitigation efforts, validating fixes, and mobilizing response teams. However, the success of CTEM is contingent upon the quality and reliability of asset data. Research indicates that only a quarter of security and IT leaders fully trust the data driving their security decisions, highlighting a significant challenge in the industry. Without trustworthy asset intelligence, every stage of CTEM can be compromised, leading to ineffective risk management. Organizations must therefore invest in tools and processes that consolidate fragmented data from various sources into a single, reliable asset inventory. This enables more accurate scoping, discovery, and prioritization of threats, ultimately strengthening the organization's security posture. The integration of CAASM/EASM tools with CTEM frameworks represents a best practice for modern cybersecurity programs, ensuring that organizations can stay ahead of evolving threats. By maintaining a hardened and well-understood attack surface, businesses can reduce the likelihood of successful cyberattacks. The ongoing evolution of these tools and frameworks reflects the increasing complexity of enterprise IT environments and the need for continuous, data-driven security management. As cyber threats become more sophisticated, the importance of asset intelligence and attack surface management will only continue to grow. Security leaders are encouraged to evaluate their current capabilities and address gaps in asset visibility and data trustworthiness. Ultimately, a robust approach to asset intelligence and attack surface management is foundational to any effective cybersecurity strategy.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations are increasingly recognizing that simply investing in cybersecurity technologies such as firewalls, SIEMs, and endpoint detection and response (EDR) platforms does not guarantee effective protection against cyber threats. Despite significant expenditures on these tools, attackers continue to exploit misconfigurations, untested rules, and hidden dependencies that evade even the most advanced security environments. A major challenge lies in the misplaced confidence that security teams place in their technology stack, often assuming that controls are functioning as intended without continuous validation. This lack of ongoing assessment can result in underutilized investments, unnoticed security gaps, and operational inefficiencies, ultimately eroding the return on investment (ROI) of security programs. Many organizations focus on the costs and budget allocations of their cybersecurity tools but rarely measure whether these investments are actually effective at the point of need. For example, a next-generation firewall may be capable of blocking advanced threats, but improper configuration can leave critical blind spots. Similarly, endpoint protection platforms may fail to trigger detections during real attacks due to internal telemetry gaps. To address these issues, the cybersecurity industry is witnessing a shift from traditional, periodic vulnerability management (VM) to Continuous Threat Exposure Management (CTEM). CTEM, a term popularized by Gartner, emphasizes the need for continuous, proactive, and automated assessment, prioritization, validation, and remediation of exposures across an organization’s entire attack surface. Unlike traditional VM, which is often reactive and manual, CTEM leverages vulnerability and threat intelligence, attack simulation, and threat validation to provide comprehensive visibility and optimize risk prioritization and remediation. This evolution aims to help organizations coherently understand and manage risk across diverse environments, including endpoints, cloud, SaaS, and code repositories. The adoption of CTEM is driven by the need to address growing vulnerability backlogs, capacity and reliability issues with vulnerability databases, and the demand for actionable, business-aligned risk management. By continuously validating security controls and exposures, organizations can ensure that their investments are delivering measurable protection and are aligned with business outcomes. This approach also helps security teams move away from a perpetual search for new tools and instead focus on optimizing and validating the effectiveness of existing technologies. Ultimately, the integration of continuous validation and CTEM practices is becoming essential for organizations seeking to maximize the ROI of their cybersecurity investments and maintain robust defenses in an increasingly complex threat landscape.
Jun 29, 2026
Organizations are increasingly turning to exposure management and Continuous Threat Exposure Management (CTEM) frameworks to address the challenges of fragmented visibility and risk prioritization in cybersecurity. Security teams often face an overwhelming influx of data from various tools such as vulnerability scanners, identity and access management (IAM) systems, cloud posture platforms, and attack surface monitoring solutions, each providing only a partial view of organizational risk. This fragmented approach can lead to confusion, undermine business confidence, and make it difficult for CISOs to demonstrate measurable risk reduction to boards and regulators. CTEM was developed as a structured, repeatable process to unify discovery, prioritization, validation, and mobilization, aiming to bridge the gap between technical insights and business impact. However, many organizations struggle to move beyond the conceptual stage of CTEM, often using it as a diagnostic tool rather than a means to drive actionable risk reduction. This can create a false sense of progress, where dashboards and reports abound but real security improvements lag behind. Case studies from companies such as Drogaria Araujo, Tenable, and Verizon illustrate the tangible benefits of implementing exposure management platforms. Drogaria Araujo, for example, leveraged exposure management to enhance attack surface visibility and provide the CISO with the necessary context to report on high-risk exposures and demonstrate compliance with Brazil’s General Data Protection Law (LGPD). Before adopting exposure management, Drogaria Araujo’s security efforts were hampered by noisy vulnerability assessments that failed to integrate findings from cloud, identity, or operational technology (OT) systems, resulting in an unmanageable volume of remediation tickets. By unifying siloed data and prioritizing risks that create attack paths to critical assets, these organizations were able to improve their security posture and compliance outcomes. The exposure management maturity model, which includes stages from Ad Hoc to Optimized, provides a roadmap for organizations to advance their cybersecurity programs. Implementing exposure management principles is seen as a crucial step for organizations seeking to mitigate cyber threats effectively. Despite the promise of CTEM and exposure management, the execution gap remains a significant challenge, with many organizations still working to translate conceptual frameworks into deliverable, measurable security outcomes. The experiences of these companies highlight the importance of moving beyond diagnostics to actionable risk reduction, ensuring that security investments lead to real improvements in organizational resilience. As regulatory scrutiny increases and attackers become more sophisticated, the ability to connect visibility to measurable outcomes is essential for maintaining business confidence and reducing liability. The integration of exposure management platforms can help organizations overcome the limitations of fragmented security tools, providing a holistic view of risk and enabling more effective prioritization and remediation. Ultimately, the shift from conceptual frameworks to deliverable solutions is critical for organizations aiming to stay ahead of evolving cyber threats and regulatory demands.
Jun 29, 2026
Organizations are facing a rapidly evolving cyber risk landscape as the boundaries between IT, operational technology (OT), Internet of Things (IoT), and supply chain systems blur. The proliferation of connected devices, such as cameras, badge readers, HVAC systems, and factory controllers, has significantly increased the attack surface for enterprises. Business demands have driven the integration of IT, OT, and IoT, enabling telemetry to inform analytics and automation, but also concentrating dependencies on critical control planes like cloud consoles and APIs. This interconnectedness means that a single compromised identity provider, software updater, or remote management tool can serve as a single point of failure, potentially impacting thousands of endpoints and critical business processes. Security leaders emphasize the importance of maintaining a living inventory of assets, applying least privilege principles, and segmenting networks by function and criticality to mitigate these risks. Unknown or unmanaged devices should be treated as unsafe until proven otherwise, and where devices lack robust security features, organizations are advised to broker connections through secure gateways. The challenge is compounded by resource constraints and the long lifecycles of many IoT and OT devices, which often cannot be easily updated or replaced. The expansion of cyber risk also extends to the supply chain, where third-party vendors, contractors, and service providers can become entry points for attackers. Recent high-profile breaches have demonstrated that adversaries exploit trusted relationships to infiltrate organizations, with the fallout often affecting the victim company regardless of where the breach originated. This complexity is frequently invisible to the public and regulators, leading to reputational damage and loss of narrative control for affected organizations. Effective cyber readiness now requires extensive preparation, including scenario exercises, communication planning, and training to operate under pressure. The shift from endpoint-centric to control plane-centric risk management reflects the need to address the realities of modern, interconnected business environments. Organizations must adopt an "assume breach" mindset and focus on resilience and recovery planning, not just prevention. The evolving threat landscape demands that security strategies account for the full spectrum of connected assets and the intricate web of dependencies that define today's enterprises. As the definition of cyber risk continues to expand, so too must the approaches to visibility, segmentation, and incident response. Ultimately, the ability to manage and recover from cyber incidents hinges on preparation, visibility, and the recognition that every connected asset and relationship represents a potential risk vector.
Jul 12, 2026