Keith C. Wilson

TOOL · CTEM PILOT ONE-PAGER

Your CTEM pilot proposal doesn’t need 15 slides.

It needs three things. The problem usually isn’t the idea. It’s that the proposal was written for a security audience instead of a business decision-maker.

1. One asset group. Not your whole environment.

“External-facing web applications” is a real scope. “Our attack surface” is not. CISOs approve specific asks.

80 characters left

2. A 30-day time box.

Open-ended pilots don’t get approved. Name the end date and define what “done” looks like before you start.

280 characters left

3. A before/after in their language.

Not “reduced CVE count.” Say what your CISO is already asking.

280 characters left

280 characters left

Everything else

Put everything else in an appendix or hold it for Q&A.

80 characters left

Proposal: 30-day CTEM pilot on [asset group]

The ask: Approve a 30-day CTEM pilot on [asset group], [start] to [end].

Scope: one asset group

[asset group]

Time box: 30 days

Done looks like: [what done looks like]

Before and after

Today: [where things stand]In 30 days: [what you'll know]

  • Name one asset group.
  • Pick a start date.
  • Define what “done” looks like.
  • Describe where things stand today.
  • Describe what you’ll know after 30 days.

If you can’t fit it on one page, you haven’t made the decision simple enough yet.

One-page pilot format: Keith C. Wilson.

Going deeper on CTEM: Foundations of CTEM is free on AttackIQ Academy.