How do you scope a first CTEM cycle you can actually finish?

Why scope at all?

A programme that tries to cover everything at once produces the same backlog as before. Gartner's public guidance is to align assessment and remediation with threat vectors or business projects rather than with infrastructure components alone. In practice that means choosing a slice of the estate the business recognises.

What makes a good first scope?

• Recognisable. A business service, a brand or an acquisition that leaders can name.
• Finishable. Small enough that the top findings can be fixed or mitigated within the cycle.
• Owned. Someone accountable for the service agrees to take the fixes.

A recent acquisition is often a good first scope: its assets are the least known, and the business wants assurance about what it bought.

Who needs to be in the room?

The security team running the cycle, the owner of the scoped service, whoever can approve a compensating control such as a WAF rule, and someone who can accept risk for findings that will not be fixed this cycle.

What happens in the cycle?

Find the assets and exposures in scope, rank them by business impact and evidence of exploitation, prove the top ones, then fix or mitigate and confirm. Our CTEM explained page describes the cycle in plain terms and maps tool types to each step.

What do you report at the end?

• How many exposures in scope were confirmed exploitable at the start, and how many at the end.
• Which were fixed, which were mitigated with a compensating control, and which were accepted.
• How long confirmed exposures stayed open.
• What you learned about the scope that changes the next cycle.

What next?

Choose your scope, then answer the exposure finder questions with that scope in mind. Read Writing a proof of concept plan before you trial any tool.