CTEM 101 – Why Cybersecurity Needs a New Approach (And What it’s Got to do with Peanut Butter)

Stop me if you’ve heard this before: You invest heavily in cybersecurity, you patch your systems regularly. And yet, you worry about unseen threats lurking in your network. And yet, you still feel that you’re not nailing it and are more vulnerable than you care to admit. And yet, while everyone accepts your metrics around what’s being patched, you’re pretty sure they may create a false sense of security.

If this scenario illustrates one thing, it’s that as cyber threats grow more sophisticated, traditional vulnerability management must be improved. It’s a common story and is precisely why Continuous Threat and Exposure Management (CTEM) has emerged as a vital evolution in cybersecurity.

I’m Jason Fruge, Resident CISO at XM Cyber. I’ve been the CISO for several large organizations and spent nearly 30 years navigating the complexities of cybersecurity. From watching the threat landscape evolve to understanding the limitations of our defenses, I’ve seen first-hand the need for a more proactive and integrated approach. CTEM offers just that — a comprehensive strategy that identifies all vulnerabilities and exposures, not just missing patches and configuration issues, and continuously monitors and mitigates risks in real time. 

In this series of blogs to follow, we’ll cover why CTEM is needed (that’s the one you’re reading now), the resources you’ll need to implement your CTEM program, how to measure if it’s actually working, and then finally, we’ll take a look at CTEM in real life scenarios.

Traditional VM, or Why the Peanut Butter Approach Doesn’t Work

That’s all fine and well – but what’s all this got to do with peanut butter, you ask?

Well, think about how most organizations handle security today. We spread our resources thin, trying to cover every possible vulnerability and/or exposure like peanut butter on bread. We don’t want said spread to be too heavy or too light, so we strive to cover all areas equally. The result? It is a fine (yet delicious) coating spread very thin, ensuring everywhere is accounted for. 

The problem with this approach is that not all risks are created equal. Some are far more likely to be exploited, and when considering the total exposure, some assets will have a much more significant impact on the business if they are exploited. Also, this traditional approach doesn’t incorporate all exposure data, typically failing to factor in identity or keys with missing patches and configuration issues, so you can’t see the big picture regarding your exposure.

CTEM flips the old script. It’s about understanding your unique threat landscape and focusing your efforts where they’ll make the most crucial difference. Instead of spreading out a uniform layer of protection, CTEM enables you to prioritize and allocate resources intelligently. It swaps the fine, even and unvarying coating for targeted efforts, which leads to better results.

How CTEM Improves on the BP Approach

Continuous Assessment:

CTEM constantly assesses your systems, software, and digital footprint for exposures and vulnerabilities. It’s like having a 24/7 security guard patrolling your network. This is continuous pen testing of your entire environment in a frictionless way.

Threat Intelligence:

CTEM taps into current threat data to understand the latest attack trends and tactics and adapts its testing process. This helps you anticipate where threat actors are likely to strike next.

Real-world Validation:

This is where the rubber meets the road. It’s the crucial step where theoretical risks are tested to determine their real-world impact and the effectiveness of your existing security controls. Validation maps out and confirms attack paths around your hybrid environment if a vulnerability or exposure is exploited.

Risk Prioritization:

Armed with this knowledge, CTEM helps you assess the potential impact of each risk and prioritize your response accordingly. You can focus on fixing the vulnerabilities and exposures that pose the greatest threat to your business, not just the ones that are easiest to find.

Why CTEM Excites Me

As a cybersecurity professional, I’ve seen firsthand how ineffective the peanut butter approach can be. We spend countless hours patching minor vulnerabilities while major risks slip through the cracks. CTEM offers a more innovative, strategic way to defend against cyber threats and use your scarce resources most effectively to protect your business. By focusing our resources on the risks that matter most, we can:

Reduce our attack surface:

Make it harder for attackers to find and exploit weaknesses in our systems.

Achieve increased resilience:

By shifting to a more proactive approach, when incidents occur, they have minimal impact on your critical business operations.

Maximize security ROI:

Get the most value from our limited security budgets.

The CTEM Revolution

CTEM is more than just a new set of tools and techniques. It’s a fundamental shift in how we think about cybersecurity. It’s about moving from a reactive, one-size-fits-all, highly uniform approach to a proactive, risk-based, and tailored approach that aligns security with business goals. I believe CTEM is the future of cybersecurity. It’s time to put the peanut butter back where it belongs (between thick slices of toasted 7-grain bread, thinly sliced bananas, and a generous coating of high-quality strawberry jam) and embrace a more innovative, more effective way to protect our organizations.