Notifications
Clear all
Topic starter
02/08/2026 11:23 am
TL;DR: CTEM is widely understood in theory, but many programmes still fail because discovery, prioritisation, remediation, and verification are not run as a repeatable operating model, according to Horizons.ai. The limiting factor is governance and execution, not framework knowledge, and that makes operational ownership the decisive control.
NHIMG editorial — based on content published by Horizons.ai: CTEM Isn’t Failing. It’s Not Being Operationalized
Questions worth separating out
Q: How should teams operationalise CTEM beyond the framework phases?
A: Teams should turn CTEM into an operating model with clear owners, handoffs, closure criteria, and verification gates.
Q: Why do exposure programmes stall even when teams understand CTEM?
A: They stall because understanding the phases does not solve accountability.
Q: What do security teams get wrong about delegated remediation?
A: They often treat delegation as a convenience feature rather than a governed access path.
Practitioner guidance
- Define a CTEM operating model Map Scope, Discover, Prioritize, Validate, and Mobilize to named owners, handoffs, and closure criteria so every exposure has a visible path to verified remediation.
- Require evidence-based validation Do not close exposures on ticket completion alone.
- Align identity and infrastructure teams on one outcome metric Use a shared reduction metric across IAM, PAM, cloud, and application teams so the programme measures decreased attacker opportunity rather than isolated task throughput.
What's in the full article
Horizons.ai's full blog covers the operational detail this post intentionally leaves for the source:
- How the vendor maps continuous validation into its own proactive security workflow and reporting model
- Examples of how findings are verified after remediation, rather than simply marked complete
- Operational guidance on turning exposure management into a repeatable hack, fix, verify, and repeat cycle
- The webinar and demo paths the vendor uses to show its approach in practice
👉 Read Horizons.ai's analysis of why CTEM programmes stall without operationalisation →
CTEM operationalization: why exposure programs stall in practice?
Explore further
02/08/2026 12:40 pm
CTEM fails when organisations confuse process movement with risk reduction. The article is right to separate understanding from operationalisation, because frameworks rarely fail in the abstract. They fail when the organisation cannot turn detection into accountable action and measurable improvement. In identity programmes, that distinction mirrors the difference between seeing an over-privileged account and proving that the privilege was removed. The practitioner conclusion is simple: if risk cannot be shown to decline, the operating model is incomplete.
A question worth separating out:
Q: How do teams know CTEM is working?
A: Look for fewer high-priority exposures lingering across multiple cycles, faster movement from validation to remediation, and better alignment between identified risk and the assets attackers are most likely to target. If the dashboard grows but the remediation queue does not change, CTEM is not yet operating as a control programme.
👉 Read our full editorial: CTEM operationalization is the real exposure management problem
