Remediation ends at a ticket reply. That's the gap.
of open security issues actually get resolved in a typical month. The rest roll over — quarter after quarter.
is self-reported. When a ticket comes back marked fixed, almost no organization re-tests whether the exposure is actually gone.
workarounds tracked to expiry in most programs. Temporary mitigations quietly become permanent — and forgotten.
A loop that only closes on evidence.
EASM findings plus your scanners, CSPM, and EDR feed one normalized exposure pipeline.
KEV known exploitation, EPSS probability, and asset criticality set the order — BAS simulation proves what's actually reachable.
Dual track: patch it — or register a workaround with a named owner, an expiry date, and automatic reopen when it lapses.
Nothing closes on a claim. Rescan, retest, and BAS re-execution grade every closure — and reopen what fails.
Saying you're cured vs. passing the re-exam.
A patient who says "I feel better" isn't discharged — they pass a re-examination. The Closure Assurance Level applies the same standard to every fix: each grade is earned with evidence, never asserted.
One pane, four levels deep.
Your findings never leave your boundary.
Questions security teams ask first.
Do we have to replace our existing scanners or ticketing?+
No. Your scanners stay as discovery sources and Jira / ServiceNow stays as the workflow. CTEM sits on top, normalizes their findings, and adds the verification layer none of them provide.
Is our data used to train external AI models?+
No. Core verdicts run on deterministic logic, and where AI assists, it can be configured as an offline or self-hosted model. Nothing is sent to external LLMs in on-prem and air-gapped deployments.
Does it work in segregated or air-gapped networks?+
Yes. On-premises and air-gapped deployment with in-house AI is a supported configuration, not a special case — it's how several of our largest environments run.
How much staffing does operating CTEM require?+
The platform is designed for one to two dedicated operators once established. Prioritization, verification scheduling, and reporting are automated; humans make the decisions the evidence supports.
How is it priced?+
Annual subscription based on managed asset count, with group and subsidiary attribution included. We calculate ROI together with your PoC results before you commit.
Scroll — CTEM closing the loop.
Scanners, EDR, cloud, ticketing — read-only connectors pull findings from the tools you already run. Nothing gets replaced on day one.
The decision layer starts by connecting, not replacing — findings flow in, decisions flow out.
Thousands of findings collapse into the few that are actually exploitable on assets that actually matter.
Priority comes from real-world exploitation and asset criticality — not from a severity label alone.
Patch when you can. When you cannot, a workaround ships with an owner, an expiry date, and an automatic reopen.
"We will patch next quarter" stops being an untracked risk — every mitigation has a clock.
"Fixed" claims are re-tested and graded on the CAL ladder — from evidence attached up to attack-path eliminated.
Below-grade closures stay "provisionally closed" — nothing silently disappears from the books.
Closure rates roll up from team to subsidiary to group, with per-team scorecards and audit-ready evidence attached.
When the audit asks "prove it was fixed", the answer is a grade and an artifact — not a ticket reply.