I had the consideration of internet hosting the primary episode of the Xposure Podcast dwell from Xposure Summit 2025. And I could not have requested for a greater kickoff panel: three cybersecurity leaders who do not simply speak security, they dwell it.
Let me introduce them.
Alex Delay, CISO at IDB Financial institution, is aware of what it means to defend a extremely regulated atmosphere. Ben Mead, Director of Cybersecurity at Avidity Biosciences, brings a forward-thinking security perspective that displays the innovation behind Avidity’s focused RNA therapeutics. Final however not least, Michael Francess, Director of Cybersecurity Superior Menace at Wyndham Lodges and Resorts, leads the cost in defending the franchise. Every introduced a novel vantage level to a standard problem: making use of Steady Menace Publicity Administration (CTEM) to complicated manufacturing environments.
Gartner made waves in 2023 with a daring prediction: organizations that prioritize CTEM might be thrice much less possible to be breached by 2026. However this is the kicker – provided that it is operationalized.
Talking with these seasoned defenders, we unpacked the realities and challenges behind the hype of implementing and operationalizing an efficient Publicity Administration technique, addressing the next powerful questions:
- What does an excellent CTEM program appear to be and what are the standard challenges that have to be overcome?
- How do you optimize cyber and danger reporting to affect board-level choices?
- And in the end, how do you measure the success of your CTEM program?
Challenges, Priorities, and Greatest Practices
CTEM is not plug-and-play. The panelists’ prescription was clear: begin with asset stock and id administration; weak service accounts, over-permissioned customers, legacy logins. None of those are small gaps, they’re wide-open doorways that have to be checked regularly. And for all of our panelists, frequency issues – so much. As a result of guess what? Adversaries are continuously difficult defenses too. For inside belongings, weekly validation is the rule of thumb. For external-facing belongings? Each day. As they see it, it is the one solution to keep a continuing deal with over their continuously altering environments.
Surprisingly, Michael pointed to risk intelligence because the spine of any security testing program. “It is advisable perceive your adversaries, simulate their TTPs, and take a look at your defenses in opposition to real-world eventualities, not simply patching CVEs.” That is the important thing distinction between CTEM and vulnerability administration. Vulnerability administration is about patching. Publicity administration is about determining whether or not your controls really work to dam threats.
Reporting: Translating Cyber to Danger Phrases
Within the banking trade, like many different extremely regulated industries, Alex could not emphasize sufficient the have to be ready to reply arduous questions requested from regulators. “You will get challenged in your publicity, your remediation timelines, and your danger therapy. And that is an excellent factor. It forces readability and accountability”.
However even exterior regulated industries, the dialog is altering. Boards don’t need to hear about CVSS scores. They need to perceive danger – and that is a totally totally different dialogue. Is the corporate’s danger profile going up or down? The place is it concentrated? And what are we doing about it?
Measuring Progress
Success in CTEM is not about counting vulnerabilities; Ben pinned it down when he stated he measures the variety of exploited assault paths his staff has closed. He shared how validating assault paths revealed dangerous security gaps, like over-permissioned accounts and forgotten belongings. Out of the blue, danger turns into seen.
Others took it in one other path with tabletop workouts that stroll management via actual
assault eventualities. It isn’t about metrics, it is about explaining the danger and the results. A shift that strikes the dialogue from noise to sign, and offers the enterprise readability on what issues: the place we’re uncovered, and what we’re doing about it.
From Idea to Motion
Need to hear how these defenders are placing CTEM into motion with out drowning in noise?
This episode dives deep into the true questions: the place do you begin, how do you keep centered on what’s exploitable, and the way do you join all of it to enterprise danger? You will hear first-hand how security leaders like Alex, Ben, and Michael are tackling these challenges head-on, with just a few surprises alongside the way in which…
🎧Be sure that to catch the total dialog on Apple Podcast and Spotify
Word: This text was expertly written and contributed by Aviv Cohen, CMO of Pentera.
