The 5 Stages of CTEM Explained for Beginners

• The five stages of CTEM in beginner language
• The single question each stage answers
• One running example that follows all five stages
• How the stages hand off to each other
• How to run a first cycle end to end

Stage 1: Scope

Question: What are we protecting this cycle and why?

Scope is where the cycle starts. The security team, working with business owners, picks the services and assets that this cycle will focus on. Scope is not a wish list; it is a bounded set that can realistically be covered in one cycle.

Example. An online store's payment service is chosen for the first cycle because it handles customer card data and any incident there is visible to customers and regulators.

Output: A one-page scope brief listing the business service, its key assets, and its business owner.

Stage 2: Discover

Question: What actually exists in scope, including forgotten items?

Discover finds every asset, identity, and exposure within the chosen scope. It pulls from vulnerability scanners, cloud posture tools, identity tools, external attack surface tools, and any other source that knows something about the scope.

Example. Discovery finds the payment web application, its database, a linked storage bucket, three admin accounts, a deployment pipeline, and one internal microservice with no listed owner.

Output: A live exposure register with each finding, its source, and the affected asset.

Stage 3: Prioritize

Question: Which of these should we fix first and why?

Prioritize ranks exposures using business impact, reachability, exploitability, and threat activity. Severity score alone is never enough. The output is a short ranked list that reflects real risk to the chosen scope.

Example. The public storage bucket ranks first because it is reachable from the internet and holds customer data. An unused admin account ranks second because compromise would allow lateral movement to the customer database.

Output: A ranked short list with reasoning attached to each item.

Stage 4: Validate

Question: If an attacker tried this today, would it work?

Validate confirms the top exposures are real, reachable, and exploitable in the current environment. Validation methods range from safe read-only checks to controlled offensive tests and breach-and-attack simulation. Retest after remediation is part of Validate, not Mobilize.

Example. A safe check confirms the bucket is world readable. A controlled test in a lower environment shows the admin account can reach the customer database. Both are documented with evidence.

Output: Validation notes and evidence for each priority exposure.

Stage 5: Mobilize

Question: Who owns the fix, by when, and how do we know it worked?

Mobilize drives closure. It assigns each validated exposure to the correct owner, applies an SLA based on severity, tracks progress, and captures evidence before closing the ticket. Mobilization is where the program earns its keep.

Example. The cloud owner locks the bucket within one day. The identity team removes the excess access within the week. The library is patched in the next release. Each closure is proven, not assumed.

Output: Closed tickets with owner, timestamp, evidence, and any exceptions.

The stages side by side

How the stages hand off

Every hand-off has an artifact. Scope hands Discover a written brief. Discover hands Prioritize a register. Prioritize hands Validate a ranked list. Validate hands Mobilize evidence. Mobilize hands the next cycle a closed set with lessons. If any hand-off is a spreadsheet nobody reads, the loop breaks.

Running a first cycle

A first cycle is the fastest way to learn CTEM. Pick one business service. Run all five stages on it. Time each stage. Capture what worked and what did not. The second cycle will be materially better and will not need a big transformation project. See How to Start a CTEM Program for a 30/60/90-day plan.

To see the full framework that sits behind the five stages, read the CTEM Framework. For a full narrative of a cycle, jump to How CTEM Works in Real Life.

• Pick one business service and draft a one-page scope brief for it
• Sketch each stage's owner and output on a single sheet
• Run a two-week first cycle on that service, timing each stage
• Publish the resulting exposure register with named owners
• Retest every closed exposure before moving to the next cycle

• Trying to boil the ocean in Scope
• Treating Discover as a data-collection project without a register
• Prioritizing on severity alone
• Skipping Validation to save time
• Closing Mobilize tickets without evidence