Harmeet Kalra
Regional Sales Director, India & SAARC, Picus Security
Picus Security is the worldwide pioneer of Breach & Attack Simulation technology. With over a decade’s experience in helping more than 500 customers globally on their security posture management journey, Picus is leading the charter of security validation into its emerging realms.
THE CONCEPT OF CTEM
The offensive security validation space is enriched with multiple technologies - BAS, CART, ASM, so forth. Continuous Threat Exposure Management or CTEM is a framework which helps to align data, people, and processes to drive safer, more efficient organizational outcomes.
“The CTEM framework offers a five-step approach made up of Scoping, Discovery, Prioritization, Validation, and Mobilization in order to connect Exposure Assessment with Exposure Validation,” says Harmeet Kalra, Regional Sales Director, India & SAARC, Picus Security. “Exposure Assessment is the process of gathering and correlating one’s vulnerability, attack surface, and threat data into one place. Exposure Validation offers the ability to validate whether an exposure is exploitable. Thus, Exposure Validation enriches Exposure Assessment with insights derived from the attackersʼ perspective. This context includes the ability to understand the ease with which vulnerabilities can be exploited, the available attack paths to critical assets, and the effectiveness of existing security controls.”
Gartner predicts that by 2026, organizations that prioritize their security investments based on a CTEM program will be three times less likely to suffer a breach.
CRITICAL SECURITY ISSUES CTEM TARGETS
“This is where we are today - 16,000+ CVEs, growing 30% year-over-year; 61% marked high or critical. And yet, we know most of them aren’t even exploitable in real-world environments. We don’t have a quantity problem, we have over-prioritization problem which leads to real pains like Resource Misallocation as time and effort are spent on patching low-risk or irrelevant vulnerabilities, while truly dangerous ones may be missed; Remediation Inefficiency as patching efforts become reactive and scattershot, often disrupting operations with minimal risk reduction; Security/IT Team Burnout as constant fire-fighting, false alarms, and unrealistic patching expectations wear down teams; Inaccurate Risk Assessments as reports may suggest high risk where none exists and miss actual risk areas, misleading stakeholders; and Credibility Loss if security teams consistently cry wolf or fail to show measurable improvements, trust erodes among business leaders,” explains Harmeet.
With its unique Adversarial Exposure Validation approach, Picus offers an evidence-centric exposure score, which truly reflects the attacker’s perspective based on validated security control effectiveness and real-world exploitability rather than theoretical ones. With its proven capabilities in specific and actionable recommendations to strengthen security controls, Picus improves security effectiveness by mitigating exposures quickly and easily.
SELECTING AN IDEAL EXPOSURE VALIDATION TOOL
“At the foremost, determine the types and recency of threats a tool can simulate and its coverage against the MITRE ATT&CK framework. Ask the vendor’s SLA for emerging threat support and releases. Next, check for exposure assessment support, as some exposure validation tools integrate with ASM & VM solutions, while others offer their own native capabilities, which can streamline your workflow even further.
It is vital to understand the extent to which a tool can integrate and validate your choice of security controls, plus ingest attack surface, vulnerability, and cyber threat intelligence data. Since offensive security is seen as a red-skills area, an often-missed aspect in tool evaluation is mitigation ability and support - the tool should not only be capable of identifying and prioritizing exposures, it should also supply one-click fixes to help you mitigate them quickly. Lastly, ease of operations is key to realize a swift time to value equation, look for an exposure validation tool that can be set up and configured in hours, not days. Identify a tool that can perform validation testing in your environment without disrupting,” says Harmeet.
