CTEM Lifecycle: The Five Stages Explained

• What each of the five stages does
• How the stages connect and feed each other
• A worked example of one full cycle
• How to keep the cycle running continuously

The five stages at a glance

1. Scope — pick a business service and name its assets and owners.
2. Discover — find assets, exposures, identities, and attack paths in that scope.
3. Prioritize — rank by business impact, exploitability, threat activity, and control gaps.
4. Validate — prove exposures are real and reachable.
5. Mobilize — assign owners, unblock work, and close exposures.

A worked example

Scope: the customer login service. Discover: an outdated auth library, a leaked API key on a public repository, a legacy admin account with MFA disabled. Prioritize: the leaked API key is number one because it grants direct data access. Validate: the key still works. Mobilize: the key is rotated in one hour, the auth library is patched that week, the admin account is decommissioned.

Keeping the cycle continuous

Automate discovery, refresh prioritization at least weekly, run validation on the top-N exposures each cycle, and track mobilization in the same tool your engineers already use (ticketing or work management).

• Pick one service and run all five stages within four weeks
• Record the top ten exposures and their status weekly
• Automate the discovery inputs so the cycle can repeat
• Publish a monthly summary of exposures opened, validated, and closed

• Running discovery without a scope
• Prioritizing before deduplicating findings
• Skipping validation because it takes time
• Mobilizing without a named owner and a deadline