TOOL · CTEM CADENCE PLANNER
CTEM doesn’t have one cadence. It has five.
Each stage moves at its own speed, and treating them as one clock is where a lot of programs stall. Set each one on the right clock, then put the stage that really is periodic on your calendar.
1. Scoping
Scoping barely changes. Revisit it when the business changes, not on a schedule.
No calendar event: rescope when one of these happens.
2. Discovery
Discovery can run continuously. Your attack surface changes daily, so the tool watching it should too.
No calendar event: this runs all the time.
3. Prioritization
Prioritization runs whenever discovery hands it something new.
No calendar event: it starts when discovery finds something new.
4. Validation
Validation is periodic. Weekly or monthly for the paths you care about most, because validating everything all the time isn't realistic for most teams.
The only stage that goes on the calendar.
The paths you care about most
5. Mobilization
Mobilization runs on whatever cadence the actual fix takes.
No calendar event: it follows the fix, not the clock.
Cadence guidance: Keith C. Wilson. Stage names from Gartner, Implement a Continuous Threat Exposure Management (CTEM) Program.
Going deeper on CTEM: Foundations of CTEM is free on AttackIQ Academy.