Topic starter
06/09/2026 9:34 am
TL;DR: BAS, CTEM, CART, pen testing, VA and AEV solve different security problems, but most programs blur them and waste budget on mismatched controls, according to FireCompass. The practical shift is toward continuous offensive validation, because exposure discovery without exploitability testing leaves a measurable gap between visibility and risk reduction.
Editorial analysis by NHI Mgmt Group, based on content published by FireCompass: “BAS, CTEM, CART, Pen Test, VA, AEV, COST: What Each Actually Does, and When to Use What”.
Key questions
Q: Where does exposure management fail when teams skip validation?
A: Exposure management fails when discovery is treated as the finish line.
Q: Why do BAS and CART produce different security answers?
A: BAS checks whether known techniques are detected or blocked by defensive controls, while CART tries to reach a real objective through an adaptive attack path.
Q: What are the signs that vulnerability scans are not enough?
A: They are not enough when the output is a long CVE list with no proof of reachability, chaining or business impact.
Practitioner guidance
- Separate exposure discovery from exploit validation Map VA, ASM, BAS, pen testing and CART to distinct programme decisions so no single tool is expected to answer all of them.
- Use CTEM to stage validation handoffs Require every discovered exposure to move from inventory into a validation step that proves reachability, exploitability or block effectiveness.
- Measure attack-path coverage, not scan volume Track how many assets are merely found versus how many are tested for chaining into privileged access, lateral movement or data access.
Bottom line: BAS, CTEM, CART, VA, ASM and AEV solve different operational problems, and conflating them creates control gaps as well as duplicate spend.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 9:34 am
Exposure discovery and exploit validation are different governance problems: organisations that treat them as one control end up funding visibility without reduction in compromise likelihood. VA, ASM, BAS and CART each sit at a different point in the security decision chain. The governance failure is category collapse, where reporting volume is mistaken for defensive progress. Practitioners should map each tool to the question it actually answers.
A question worth separating out:
Q: Should organisations prioritise continuous testing over annual penetration tests?
A: Yes, in high-change environments. Continuous testing is more aligned to how autonomous attackers operate and gives teams faster feedback on exposure, especially where APIs, web apps, and shadow AI change often. Annual tests still have value, but they are too slow and too narrow to serve as the primary assurance model.
👉 Read our full editorial: BAS, CTEM and CART: where offensive security categories diverge