PLATFORM/CTEM
LIVE — GLOBAL

Not just finding — proving what's fixed.

CTEM closes the remediation loop your tools leave open: every exposure gets an owner, every closure gets an evidence grade, and your team's work becomes a number the board can read.

CAL 0–5 CLOSURE GRADESKEV + EPSS + ASSET CRITICALITY
H00DIES · CTEM CONSOLE VERIFYING
OPEN EXPOSURES
412
VERIFIED CLOSED · 30D
127
REOPENED · AUTO
9
MEDIAN CLOSURE
CAL 3
CTEM THROUGHPUT FUNNEL
ASSETS DISCOVERED 418
VULNS DETECTED 831
VALIDATION EXECUTED 311
CONFIRMED TRUE-POSITIVE 294
ACTIVE REMEDIATION 114
C/H REMEDIATION
35%
143 INITIAL C+H
50 REMEDIATED
93 REMAINING
COHORT DECAY · % STILL OPEN
2026-03100%100%79%78%
2026-04100%98%86%86%
2026-0591%81%
VERIFY QUEUE · 23NEXT RETEST 04:00MOCK DATA FOR ILLUSTRATION
Why it exists

Remediation ends at a ticket reply. That's the gap.

10–15%

of open security issues actually get resolved in a typical month. The rest roll over — quarter after quarter.

"Done"

is self-reported. When a ticket comes back marked fixed, almost no organization re-tests whether the exposure is actually gone.

0

workarounds tracked to expiry in most programs. Temporary mitigations quietly become permanent — and forgotten.

This is a system gap, not a people problem. Your teams close what they're asked to close — nobody gave them a shared, verifiable definition of done.
SOURCES: PUBLIC REMEDIATION-RATE RESEARCH · h00dies FIELD DATA — YOUR ENVIRONMENT MAY DIFFER.
How it works

A loop that only closes on evidence.

STEP 01
Discover

EASM findings plus your scanners, CSPM, and EDR feed one normalized exposure pipeline.

STEP 02
Prioritize

KEV known exploitation, EPSS probability, and asset criticality set the order — BAS simulation proves what's actually reachable.

KEV EPSS CRITICALITY BAS-PROVEN
STEP 03
Mitigate

Dual track: patch it — or register a workaround with a named owner, an expiry date, and automatic reopen when it lapses.

OWNER EXPIRY AUTO-REOPEN
STEP 04 · THE DIFFERENCE
Verify

Nothing closes on a claim. Rescan, retest, and BAS re-execution grade every closure — and reopen what fails.

CAL 0–5

Saying you're cured vs. passing the re-exam.

A patient who says "I feel better" isn't discharged — they pass a re-examination. The Closure Assurance Level applies the same standard to every fix: each grade is earned with evidence, never asserted.

Anything below your target grade stays "provisionally closed" — visible, dated, and never silently forgotten.
CAL 0 Reported A fix is claimed. No evidence yet.
CAL 1 Evidence attached Config diff, patch log, or screenshot on record.
CAL 2 Rescan passed The original scanner no longer detects the finding.
CAL 3 Retest passed Independent re-exploitation attempt fails.
CAL 4 BAS passed Breach-and-attack simulation confirms the technique no longer works.
CAL 5 Attack path eliminated No remaining route to the asset survives graph analysis.
Governance

One pane, four levels deep.

Group → subsidiary → org → team drill-down — the same numbers at every level, no reconciliation meetings.
Per-team scorecards — closure rate, median CAL, and reopen rate per owning team.
Departmental chargeback — attribute exposure and remediation cost to the unit that owns it.
Automated reports — board, audit, and team-level packs generated from the same evidence base.
Data sovereignty

Your findings never leave your boundary.

DEPLOYMENT
On-premises and fully air-gapped installs supported.
AI
In-house models — no exposure data sent to external LLMs.
VERDICTS
Deterministic closure logic — the same evidence always yields the same grade.
AUDIT
Every grade change is logged with who, what, and which evidence.
We don't replace your scanners or Jira / ServiceNow — we standardize the definition of done across them.
FAQ

Questions security teams ask first.

Do we have to replace our existing scanners or ticketing?+

No. Your scanners stay as discovery sources and Jira / ServiceNow stays as the workflow. CTEM sits on top, normalizes their findings, and adds the verification layer none of them provide.

Is our data used to train external AI models?+

No. Core verdicts run on deterministic logic, and where AI assists, it can be configured as an offline or self-hosted model. Nothing is sent to external LLMs in on-prem and air-gapped deployments.

Does it work in segregated or air-gapped networks?+

Yes. On-premises and air-gapped deployment with in-house AI is a supported configuration, not a special case — it's how several of our largest environments run.

How much staffing does operating CTEM require?+

The platform is designed for one to two dedicated operators once established. Prioritization, verification scheduling, and reporting are automated; humans make the decisions the evidence supports.

How is it priced?+

Annual subscription based on managed asset count, with group and subsidiary attribution included. We calculate ROI together with your PoC results before you commit.

See it work

Scroll — CTEM closing the loop.

SCROLL TO STEP THROUGH A LIVE-STYLE SESSION
STEP 01 · INTEGRATE
Your stack plugs in first.

Scanners, EDR, cloud, ticketing — read-only connectors pull findings from the tools you already run. Nothing gets replaced on day one.

INSIGHT

The decision layer starts by connecting, not replacing — findings flow in, decisions flow out.

STEP 02 · PRIORITIZE
What matters first.

Thousands of findings collapse into the few that are actually exploitable on assets that actually matter.

INSIGHT

Priority comes from real-world exploitation and asset criticality — not from a severity label alone.

STEP 03 · MITIGATE
Two tracks to done.

Patch when you can. When you cannot, a workaround ships with an owner, an expiry date, and an automatic reopen.

INSIGHT

"We will patch next quarter" stops being an untracked risk — every mitigation has a clock.

STEP 04 · VERIFY
Proof, graded.

"Fixed" claims are re-tested and graded on the CAL ladder — from evidence attached up to attack-path eliminated.

INSIGHT

Below-grade closures stay "provisionally closed" — nothing silently disappears from the books.

STEP 05 · PROVE
Governance that holds.

Closure rates roll up from team to subsidiary to group, with per-team scorecards and audit-ready evidence attached.

INSIGHT

When the audit asks "prove it was fixed", the answer is a grade and an artifact — not a ticket reply.

H00DIES · CTEM SYNCING
TOTAL CONNECTORS
79
CONNECTED
16
Microsoft Defender for Endpoint discoveryprioritization CONNECTED
Qualys VMDR discoveryvalidation CONNECTED
Jira mobilization CONNECTED
Azure MFA / Conditional Access validation SYNCING
READ-ONLY · FINDINGS IN, DECISIONS OUTMOCK DATA
H00DIES · CTEM TRIAGE
100 VMware vCenter RCE CVE-2021-21985 P0 KEV CVSS 9.8
WHY THIS IS P0
On CISA KEV — confirmed exploited in the wild
EPSS 1.00 — high 30-day exploit probability
Remote code execution (RCE) possible
→ Patch immediately — KEV-listed, remediation deadline passed
KEV × EPSS × ASSET CRITICALITYMOCK DATA
H00DIES · CTEM IN PROGRESS
CISA REQUIRED ACTION
Apply updates per vendor instructions
STEP-BY-STEP REMEDIATION
1. Back up / snapshot the affected system
2. Upgrade to the patched version
3. Restart the affected service
4. Run a functional smoke test
5. Request security re-validation (retest)
TEMPORARY MITIGATION
Restrict external access (WAF / segmentation) as an interim control
DUAL TRACK · AUTO-REOPENMOCK DATA
H00DIES · CTEM VERIFYING
UNVERIFIED
376
TRUE POSITIVE
446
FALSE POSITIVE
0
HIGH WordPress LFI CVSS 8.5 · SOURCE: SCANNER ✓ TRUE POSITIVE ✕ FALSE POSITIVE
AI SIGNALS — NOT OBSERVED IN 60+ DAYS · FP PROBABILITY 25%
73 P1 SSVC: ACT base 42.5 × gate 1.27 + threat 18.9 = 72.8
CAL 0–5 · CLOSURE ASSURANCEMOCK DATA
H00DIES · CTEM REPORTING
WEB APPLICATION DAST SCAN IN PROGRESS PROGRESS 50%
2
LINKED
0
CRITICAL
1
HIGH
1
EXPLOITABLE
Nginx HTTP/2 Rapid ResetCVE-2023-44487 · web-prod-01.acme-na.comMITIGATED · RE-TESTED
jQuery XSS (legacy component)CVE-2020-11023ACCEPTED · GOVERNED
EVIDENCE → AUDIT TRAILGROUP ROLLUP UPDATED
GROUP → SUBSIDIARY → TEAMMOCK DATA

Put a grade on "fixed" —
starting with your open backlog.

2-WEEK FREE ASSESSMENT · NON-DESTRUCTIVE · YOU OWN THE RESULTS