Do I need to find every asset?

In your scope, yes. Missing assets create blind spots that break prioritization.

How often should discovery run?

As continuously as possible. Daily is a good default; some inputs are real-time.

CTEM Discovery Stage: Find Assets and Exposures

What you will learn

The categories of exposure to cover
How to combine multiple discovery inputs
How to spot unknown or shadow assets
How to keep the exposure register deduplicated and clean

Explanation

Discovery categories

Assets: servers, containers, SaaS, cloud accounts, endpoints, data stores.
Vulnerabilities: CVEs on operating systems, libraries, and applications.
Misconfigurations: cloud, Kubernetes, identity, network.
Identities: over-privileged accounts, stale service principals, missing MFA.
External surface: unknown domains, exposed ports, forgotten test environments.
Third parties: vendor-managed systems that touch your data.
Secrets: keys and tokens in code or storage.

Finding unknown assets

Cross-check DNS, cloud billing, certificate transparency logs, EDR agents installed, and EASM findings. Anything that appears in one source but not another is a candidate for investigation.

How to apply this

List every source that feeds discovery for your scope
Push every finding into one exposure register with a stable ID
Deduplicate by asset + finding type
Tag each exposure with the business service it belongs to

Common mistakes

Relying on a single scanner
Skipping identity and cloud posture
Storing findings in each tool's UI and never joining them
Ignoring external attack surface for internal-only mindset

Frequently asked questions

Whatever produces asset and exposure data for your scope: vulnerability scanners, ASM/EASM, cloud security posture, identity governance, secrets scanning, SBOM, and EDR telemetry.

Lifecycle Overview

CTEM Lifecycle: The Five Stages Explained

A practical walkthrough of the five-stage CTEM lifecycle with worked examples, common pitfalls, and links to a deep-dive page for each stage.

CTEM Scope Stage

CTEM Scope Stage: Define What Matters

How to run the Scope stage of CTEM: pick business services, list critical assets, map attack surfaces, and name owners.

CTEM Prioritize Stage

CTEM Prioritization Stage: Rank Exposures That Matter

How to prioritize exposures using business impact, exploitability, threat activity, asset criticality, control gaps, and attack paths.

Templates

Free CTEM Templates: Exposure Register, Prioritization, Reporting

Free CTEM templates: exposure register, prioritization matrix, validation worksheet, reporting template, maturity checklist, remediation tracker.

Author

LearnCTEM Editorial Team

Practitioners and educators writing plain-English guides on Continuous Threat Exposure Management.

Reviewed by

Senior CTEM Practitioner Panel

Reviewed for accuracy against public CTEM guidance and real-world program experience.