Quick answer
Direct answer
A vendor-neutral CTEM glossary with meaning, why it matters, and an example for every term.
What you will learn
- Plain-English definitions for every core CTEM term
- Why each term matters inside a CTEM program
- A beginner example for every definition
- Which terms relate to each other
Explanation
How to use this glossary
Read the meaning first. If it still feels abstract, jump to the example. If you want to see the term in context, follow the related link.
Terms
| Term | Meaning | Why it matters in CTEM | Example |
|---|---|---|---|
| Asset | Something the business relies on that could be attacked or damaged. | Every exposure attaches to an asset; without an asset the exposure has no context. | The checkout web application, its database, and its storage bucket. |
| Asset owner | The named person or team responsible for an asset. | Mobilize needs a real owner to drive closure. | The cloud team owns the storage bucket. |
| Attack path | A chain of small exposures that together let an attacker reach a valuable asset. | Ranking single findings ignores how attackers chain them. | Low-privilege user, helpdesk misconfiguration, domain admin token. |
| Attack surface | Everything an attacker could touch, internal and external. | Attack surface bounds CTEM discovery. | Public web apps, cloud storage, exposed APIs, contractor accounts. |
| Breach and attack simulation | A tooling category that safely simulates attacker techniques against your environment. | One method of validation used in CTEM. | Simulating credential dumping to test detection. |
| Business impact | The consequence to the business if an exposure is exploited. | Business impact is a core prioritization signal. | Loss of card data would trigger regulatory action and revenue loss. |
| Business owner | The leader accountable for a business service, not its technical infrastructure. | Business owners confirm scope and receive outcome reporting. | Head of e-commerce for the checkout service. |
| Continuous | Running on a cadence short enough that new exposures are noticed and acted on before attackers can use them. | Continuous separates CTEM from periodic vulnerability projects. | Weekly discovery, daily prioritization on critical services. |
| Control | A measure that prevents, detects, or responds to an attack. | Controls affect prioritization; a mitigated exposure ranks lower. | A WAF rule that blocks the payload of a known CVE. |
| Discovery | The CTEM stage that finds every asset and exposure in scope. | The register cannot be complete without solid discovery. | Pulling scanner, cloud, and identity data into one register. |
| Escalation | An agreed path to force decision or action when SLAs are at risk. | Without escalation, Mobilize stalls silently. | Asset owner then manager then service owner then CISO. |
| Evidence | The proof that an exposure is real, or that it has been closed. | Evidence is what separates CTEM closure from ticket close. | A retest showing the storage bucket is now private. |
| Exception | A documented decision to accept an exposure rather than remediate it. | Exceptions track known accepted risk and force review at expiry. | Legacy system exception with defined expiry and compensating control. |
| Exploitability | Whether an attacker can actually use an exposure in your environment today. | Prioritization must consider exploitability, not just severity. | A CVE with public exploit code and no compensating control. |
| Exposure | Any condition an attacker could use to cause harm. | Exposure is the broader unit that CTEM operates on. | A misconfiguration, a leaked key, or an excess-privilege account. |
| Exposure register | The single record of all exposures across the CTEM loop. | The register is the source of truth from Discover through Mobilize. | A shared table with source, asset, category, stage, and owner. |
| External attack surface | The subset of the attack surface reachable from the public internet. | External surface often ranks first in prioritization. | Public web apps, exposed APIs, forgotten staging environments. |
| Mobilize | The CTEM stage that drives owned remediation with evidence. | Nothing closes without Mobilize. | Ticket routed to cloud team, SLA applied, evidence attached at close. |
| Prioritize | The CTEM stage that ranks exposures by business impact and attackability. | Prioritize turns thousands of findings into a short ranked list. | Storage bucket ranks first, unpatched CVE ranks fourth after compensating WAF. |
| Reachability | Whether an attacker can actually reach an exposure from a realistic starting point. | Unreachable exposures should not consume prioritization budget. | An internal-only service behind zero-trust access is not reachable from the internet. |
| Remediation | The technical fix applied to close an exposure. | Remediation is the visible output of Mobilize. | Patch, config change, key rotation, role reduction. |
| Risk | The probability and business impact of exposure being exploited. | Risk is the language of leadership and the board. | High probability plus high impact equals top risk. |
| SLA | A service level agreement defining how quickly a validated exposure must be closed. | SLAs turn prioritization into deadlines. | Critical validated exposure closed within seven days. |
| Scope | The CTEM stage that decides which business services and assets a cycle will cover. | Scope prevents the program from boiling the ocean. | This cycle covers the checkout service and its dependencies. |
| Threat | The adversary capability, technique, or activity that could exploit an exposure. | Threat context turns exposure into ranked priority. | Ransomware operators using a specific CVE against the retail sector. |
| Validate | The CTEM stage that confirms an exposure is real, reachable, exploitable, and still present after remediation. | Validate is the honesty check for the whole loop. | Retesting a closed misconfiguration to confirm it did not regress. |
| Vulnerability | A specific technical weakness, often with a CVE identifier. | Vulnerabilities are one important input to the exposure register. | An unpatched CVE in a web framework. |
Common confusions
- Vulnerability vs exposure. Every vulnerability is an exposure; not every exposure is a vulnerability.
- Threat vs threat actor. A threat actor is the who. A threat is the what.
- Risk vs severity. Severity is technical; risk includes business impact.
- Remediation vs mitigation. Remediation removes the exposure; mitigation reduces its impact.
- Validate vs verify. Verify checks that something was done; validate checks that it works against an attacker.
To see the terms applied end to end, read How CTEM Works in Real Life. For the four related terms in depth, see Exposure vs Vulnerability vs Threat vs Risk.
How to apply this
- Bookmark this glossary and use it as a shared reference during CTEM meetings
- Adopt these definitions in your own program documents
- Add any organization-specific terms alongside these
- Correct one recent report where a term was used loosely
- Share the glossary link with a business stakeholder before your first review
Common mistakes
- Using vulnerability, exposure, and risk as if they were the same
- Adopting a vendor's proprietary vocabulary as the program standard
- Skipping a shared glossary until conflict about terms slows the cycle
- Defining terms informally in each report so definitions drift
Key takeaways
- Shared vocabulary is one of the fastest ways to unstick a program.
- Every term needs a meaning, a reason it matters, and an example.
- Vulnerability, exposure, threat, and risk are related but distinct.
- Remediation and mitigation are not the same thing.
- Validation is different from verification.
Frequently asked questions
It covers the most common CTEM terms used across this site. Security is a wide field; specific terms in identity, cloud, or application domains have deeper glossaries elsewhere.
Related pages
What is CTEM?
What is CTEM? Continuous Threat Exposure Management Explained
CTEM (Continuous Threat Exposure Management) explained in plain English: definition, why it exists, and how it works as an operating model, not a tool.
Exposure vs Vulnerability vs Threat vs Risk
Exposure vs Vulnerability vs Threat vs Risk: Clear Comparison
The clearest comparison of exposure, vulnerability, threat, and risk with a definition table and one scenario that follows all four terms end to end.
What is a Cyber Exposure?
What is a Cyber Exposure? Meaning, Examples, and Types
A cyber exposure is any weakness, misconfiguration, excessive access, or condition an attacker could use to cause harm. Clear examples and beginner definitions.
CTEM Framework
CTEM Framework: The Complete Operating Model Explained
The full CTEM framework: five stages, inputs, outputs, roles, cadence, and how scope, discovery, prioritization, validation, and mobilization connect.
Next step
Return to: What is CTEM?
Apply the vocabulary to the pillar overview.
Author
LearnCTEM Editorial Team
Practitioners and educators writing plain-English guides on Continuous Threat Exposure Management.
Reviewed by
Senior CTEM Practitioner Panel
Reviewed for accuracy against public CTEM guidance and real-world program experience.
Sources and further reading
- ▸NIST SP 800-30, Guide for Conducting Risk Assessments. Public definitions of asset, threat, vulnerability, and risk.
- ▸ISO/IEC 27005, Information security risk management. Standard terminology consistent with this glossary.
- ▸Gartner, Implement a Continuous Threat Exposure Management (CTEM) Program (2022). Introduces the CTEM-specific vocabulary used across the site.