Exposure Management: definition, stakes, and how it works

Who is this article for?

This article is written for anyone involved, in one way or another, in reducing an organization's cyber risk:

• CISOs and cybersecurity leaders, who drive the risk-reduction strategy

• SOC and Blue Team members, responsible for detection and incident response

• Pentesters and Red Teams, who validate the real-world exploitability of exposures

• Risk managers and compliance officers, notably on DORA and NIS2

• IT and DevOps teams, who own the exposed assets day to day

This first section lays out the basic definition: what an exposure is, why the CVSS score alone isn't enough to measure its risk, and how this discipline relates to CTEM.

A security team closes a ticket on a Friday: the month's critical CVE has been patched. The following Monday, the company is hit by ransomware that came in through a service account left unattended for three years. No CVE involved, no alert triggered. Just an exposure nobody had linked to a real attack path.

Exposure Management continuously identifies, assesses, prioritizes, and reduces the full range of an organization's cyber risk exposures: technical vulnerabilities, misconfigurations, poorly managed identities, shadow IT, attack paths. A single exposure, taken in isolation, may look minor; combined with others, it becomes a complete attack path, as in the example above.

Vulnerability management checks each flaw one by one. Exposure Management asks a different question: where would an attacker actually get in? A high CVSS score says nothing about whether a flaw is reachable from the internet, whether it sits in test or production, or whether a compensating control already neutralizes it. It measures the theoretical severity of an isolated flaw, not the real risk it poses to the organization.

🗣️ "For a long time, we asked security teams to patch faster. The real issue is patching in the right place."
Vladimir Kolla -Patrowl Co-founder

This logic (attack surface discovery, exploitability validation, risk-driven remediation) is what structures Continuous Threat Exposure Management (CTEM), the framework defined by Gartner that Patrowl operationalizes through its platform.

This logic explains why the topic gained traction so quickly among security teams. The next section details the scale of the problem through three figures.

This section answers a simple question: why now? Four data points are enough to measure the scale of the problem.

A volume of CVEs that outpaces human capacity

More than 48,000 CVEs were published in 2025, bringing the cumulative catalog since 1999 to over 308,000. The pace accelerated further in 2026: the first half alone produced 35,364 CVEs, up 49.5% on the same period in 2025, putting the full year on track for 71,000 to 72,000 CVEs [1]. Yet of those 35,364 CVEs from the first half of 2026, only 85 (0.24%) are recorded as actively exploited in the CISA KEV catalog [1]. Volume has outpaced human capacity to triage one by one, but the real issue lies elsewhere: treating tens of thousands of CVEs with the same urgency drowns out the fraction that actually matters.

Insufficient visibility into the assets themselves

Gartner reports that only 17% of organizations are able to identify the majority of their own assets [2]. Before even talking about prioritization, most companies still don't know what they own.

What attackers confirm, in hard numbers

Verizon's 2025 Data Breach Investigations Report confirms the trend from the attacker's side: vulnerability exploitation has become the second most common initial access vector in breaches, present in 20% of cases, up 34% year over year, driven notably by externally exposed devices (VPNs, firewalls) [6]. Yet only 54% of vulnerabilities affecting these devices had been remediated within the year, with a median remediation time of 32 days [6]: the problem isn't just knowing what to fix, but fixing it fast enough on the assets that matter.

The promise of CTEM, with a grain of salt

Analysts predict that organizations steering their security investment through a CTEM program will see up to two-thirds fewer breaches by 2026 [3]. Worth a caveat: a more recent report mainly documents better attack surface visibility (+50%) and increased adoption of security solutions (+23 points), without a published empirical study on breach rates [4]. The market is following this shift regardless, projected to grow from $2.54 billion in 2024 to $23.26 billion by 2033 [4].

Given this volume and lack of visibility, what's needed is a structured operating framework rather than a simple scanning tool. That's the subject of the five components detailed in the next section.

This section details the five building blocks that make up an Exposure Management program in practice, from asset discovery to remediation.

This five-step cycle is what Gartner formalizes as CTEM. Our dedicated page details each of these steps and shows how Patrowl operationalizes them.

These five building blocks overlap with neighboring disciplines that are often confused with Exposure Management. The next section clarifies those distinctions, before looking at which technologies actually implement them.

This section details the technology building blocks that power an Exposure Management program, and the context in which each one becomes a priority.

No organization starts with all of these building blocks at once: the right baseline depends on maturity, industry, and existing infrastructure.

This baseline also varies with the size and profile of the organization. An SMB or mid-market company typically starts with attack surface discovery and prioritization, enough to move past a plain vulnerability list. A multi-business-unit enterprise or a regulated player (BFSI, healthcare) adds identity, cloud, and API security, along with formal compliance evidence. A cloud-first organization puts CSPM/CNAPP and cloud identity exposure at the top of its priorities. An MSSP or MSP, meanwhile, needs multi-tenant visibility and consolidated per-client reporting rather than one more tool per building block.

Once these building blocks are in place, it's worth distinguishing them from the neighboring disciplines they're often confused with.

This section distinguishes Exposure Management from three concepts it's regularly confused with: Vulnerability Management, ASM, and CTEM.

Versus Vulnerability Management. Vulnerability management answers "what flaws exist on my systems?". Exposure Management adds business context and attack paths to answer "what is my real risk, and where would an attacker go first?". All vulnerability management is part of Exposure Management; the reverse isn't true.

Versus Attack Surface Management (ASM). ASM maps what's exposed, an inventory exercise. Exposure Management picks up from there by assessing the risk of each discovered asset and driving its remediation. Many ASM projects stop at the map, with no process to act on it.

Versus Continuous Threat Exposure Management (CTEM). CTEM isn't a tool but the methodological framework that structures how Exposure Management is implemented, in five continuous phases. Discover how Patrowl implements this cycle end to end.

These distinctions remain theoretical without field evidence. The next section shows how several organizations apply them day to day.

This section brings together three customer stories that illustrate what a continuous Exposure Management approach changes, compared with a one-off audit.

MGEN (mutual insurer) points out that a classic penetration test becomes outdated the day after it's delivered, unlike continuous pentesting.

Brest Métropole (local government) received a preventive notification at 3:57 PM during the SharePoint CVE-2025-53770 vulnerability, with an alert and Blue Team mobilization by 4:36 PM.

Xplor (scale-up) moved from one-off penetration tests to a continuous stream of verified vulnerabilities, directly actionable by its engineers.

Sources: Patrowl customer testimonials. More stories (Colas, Heetch) on the testimonials page.

This continuity relies on specific tools. The next section explains what an Exposure Management platform is and the role AI now plays in it.

This section explains what an Exposure Management Platform (EMP) is and how AI is integrated into it today, at Patrowl and elsewhere.

An Exposure Management Platform (EMP) centralizes the full cycle: asset discovery, multi-scanner aggregation, correlation with threat intelligence, attack path simulation, pentest-based validation, remediation orchestration. The market approaches this from different angles (endpoint, cloud, network, threat intelligence, offensive validation) but converges on the same goal: reducing real exposure, not just the volume of alerts.

The industry is now building AI directly into triage and remediation, turning fragmented attack surface data into prioritized, actionable fixes [5]. At Patrowl, agentic AI speeds up reconnaissance and attack path detection across volumes that human experts couldn't explore manually at the same speed. Every vulnerability is still qualified by a pentester before being reported to the client, with a target of zero false positives. The infrastructure is kept in-house: no client data is processed by a third-party model.

🗣️ "AI makes us faster, but it never replaces a pentester's judgment on what's genuinely exploitable."
Vladimir Kolla - Patrowl Co-founder

These general principles play out differently depending on industry. That's the subject of the next section.

This section reviews six industries to show how their regulatory constraints and specific critical assets shape how Exposure Management is implemented.

Banking and financial services. External attack surface (online banking, payment APIs), privileged access on core systems, and continuous resilience evidence expected under the DORA regulation rather than ad hoc reporting before an audit.

Insurance. The word "exposure" originally has an actuarial meaning: the probability and scale of a covered loss. The shift toward cyber Exposure Management isn't a coincidence, both fields assess the same question (probability and cost of an adverse event), applied here to internet-facing customer portals and underwriting databases.

Public sector. NIS2 requires administrations and essential-service operators to manage risk proactively; Exposure Management provides the continuous asset mapping and remediation evidence regulators require.

Healthcare. An MRI scanner can't be patched like a web server on a Friday night: you first need to confirm a fix won't interrupt care in progress. Exposure Management helps prioritize without systematically taking equipment offline, by distinguishing what's exploitable from what isn't.

Industry and OT/ICS. SCADA environments are rarely patchable in production; discovery and validation take priority over immediate fixes, particularly at the convergence points between IT and OT networks, which are a source of new attack paths.

HR and organizations. The term sometimes refers here to the risk a given role poses to the company (sensitive access, lack of separation of duties). A forgotten admin account after someone leaves remains the most banal example, and one of the most frequent in real incidents.

These industry variations all raise the same underlying question: how do you actually measure whether the program is working? That's the subject of the next section.

This section lists the metrics that show an Exposure Management program is making real progress, beyond simply counting closed tickets.

A classic vulnerability management program is measured by the number of flaws fixed. An Exposure Management program is measured by real risk reduction, which calls for different metrics:

• Validated and reduced attack paths: the number of genuinely exploitable paths, not the number of closed CVEs.

• Internet-facing exploitable exposures: the share of the external perimeter that remains attackable at any given moment.

• Mean time to remediate validated exposures: measured on what's been confirmed exploitable, not the entire backlog.

• Share of assets under continuous discovery: a direct indicator of inventory reliability.

• Reduction in identity-related attack paths: the accounts and privileges that, combined with other flaws, open up critical access.

• Control validation rate: does a control meant to block an attack actually do so, once tested?

• Reopened exposure rate: an indicator of remediation quality, not just speed.

These metrics tie back to the most common questions on the topic, gathered in the FAQ below.

Exposure Management doesn't replace vulnerability management, it completes it with what vulnerability management can't see on its own: business context, identities, misconfigurations, and the attack paths that result from them. CTEM gives this approach a repeatable operating framework rather than a one-off audit.

For a security team, the question is no longer "how many vulnerabilities are left to fix?" but "which attack path would an adversary take today, and have we cut it off?".

[1] JerryGamblin.com, 2025 CVE Data Review (1er janvier 2026) et CVE Mid-Year 2026 Check-In (1er juillet 2026) — tracker indépendant basé sur les exports NVD JSON et CVE List V5. Chiffres complémentaires : jgamblin/monthlyCVEStats (GitHub).

[2] Kudelski Security, Strengthen Security Before It Breaks, 2025 (chiffre Gartner sur la capacité de découverte d'actifs).

[3] Gartner, Implement a Continuous Threat Exposure Management Program, 21 juillet 2022 ; prédictions CTEM 2026 relayées par Cloud Security Alliance et Nagomi Security.

[4] Vectra.ai, CTEM explained: Gartner's 5 stages and 2026 prediction, 2026 (données de visibilité, adoption et taille de marché).

[5] MQ Gestion et qualité, Check Point lance la gestion des expositions pilotée par l'IA, janvier 2026.

Témoignages clients cités : Page témoignages clients, Patrowl — retours MGEN, Brest Métropole, Xplor, Colas et Heetch.