CTEM.org
Continuous Threat Exposure Management Standards Organization
Developing vendor-neutral standards and taxonomies for Continuous Threat Exposure Management (CTEM) to simplify adoption and ensure consistency across cybersecurity products and organizations.
Started October 2024
Active Development
Open Community
What is Continuous Threat Exposure Management?
CTEM is a framework designed to reduce an organization's exposure to cyber threats through a continuous cycle of identification, assessment, and mitigation of risks in real time.
- Scoping
- Discovery
- Prioritization
- Validation
- Mobilization
Vendor-Neutral Standards
Develop unbiased, vendor-neutral approaches to CTEM ensuring consistency across products and organizations
Standardized Identifiers
Categorize threat types with standardized identifiers for consistent threat classification
Community-Driven
Collaborate with CTEM practitioners to develop practical, real-world applicable standards
Simplified Adoption
Make CTEM adoption easier through clear documentation and standardized processes
Project Objectives
What CTEM.org aims to achieve in the cybersecurity landscape
Standardize CTEM Practices
Create consistent, industry-wide standards for threat exposure management
Develop Threat Taxonomies
Build comprehensive categorization systems for security findings and threats
Foster Community Collaboration
Bring together CTEM practitioners to share knowledge and best practices
Simplify CTEM Adoption
Reduce barriers to implementing effective threat exposure management programs
CTEM Identifier Categories
Complete standardized categorization system for threat exposure management findings from the official CTEM.org documentation
Complete Framework
This section includes all 8 categories and 28 identifiers from the official CTEM.org taxonomy. The identifiers are continuously refined based on community input and real-world implementation.
Brand Impersonation
Counterfeit products and unauthorized use of corporate branding
- CTEM-BND-1
Counterfeit Product Offered For Sale Or Use
Fake products using corporate branding offered for sale or distribution
Credential Dump
Exposed credentials found in data breaches and dumps
- CTEM-DAT-1
Credentials Leaked With Hostname
Corporate credentials exposed in data breaches with associated hostnames - CTEM-DAT-2
Vendor System Dump With Credentials Offered Privately
Vendor system dumps containing credentials offered in private channels
Financial Information Exposure
Exposed financial and sensitive business information
- CTEM-FIN-1
Corporate Bank Account Routing Information Exposed
Banking routing information and account details exposed publicly - CTEM-FIN-2
Accounts Payable Information Exposure
Accounts payable data and vendor payment information exposed
Infected Device
Compromised devices across different ownership models
- CTEM-INF-1
Infected Corporate Owned Device
Corporate-managed devices compromised by malware - CTEM-INF-2
Infected Vendor Owned Device
Vendor or partner devices compromised and potentially affecting the organization - CTEM-INF-3
Infected Employee Owned Device (Corporate Credentials)
Personal devices compromised while containing corporate credentials - CTEM-INF-4
Infected Employee Owned Device (Personal Use of Corporate Identity)
Personal devices using corporate credentials for non-work activities - CTEM-INF-5
Infected Customer Owned Device
Customer devices compromised that may impact organizational security - CTEM-INF-6
Infected Employee Owned Device (Internal Network Connected)
Personal devices connected to corporate network infrastructure - CTEM-INF-7
Infected Employee Owned Device (3rd Party Business Use of Corporate Identity)
Personal devices using corporate identity for third-party business activities
Lookalike Domains
Domains created to impersonate or confuse with legitimate corporate domains
- CTEM-DOM-1
Typo Squatted Domain
Domains registered with common misspellings of corporate domains - CTEM-DOM-2
Homoglyph Attack Domain
Domains using visually similar characters to impersonate legitimate domains - CTEM-DOM-3
Phishing Indicator Domain
Domains showing indicators of being used for phishing campaigns - CTEM-DOM-4
Brand Impersonation Domain
Domains created to impersonate corporate branding and identity
Ransomware
Ransomware attacks affecting organizational assets
- CTEM-RAN-1
Ransom Dump (Supplier)
Supplier data leaked via ransomware affecting organization - CTEM-RAN-2
Ransom Dump (Customer)
Customer data exposed through ransomware incidents
Source Code Exposure
Exposed source code repositories and development artifacts
- CTEM-SRC-1
Public Source Code Repository (Company Sanctioned)
Official company repositories with potential security exposures - CTEM-SRC-2
Public Source Code Repository (Employee Created)
Employee-created repositories containing corporate code or data - CTEM-SRC-3
Public Source Code Repository (Vendor Owned)
Vendor repositories containing code related to the organization - CTEM-SRC-4
Public Source Code Repository (Unrelated 3rd Party)
Third-party repositories containing organizational references or code - CTEM-SRC-5
Public Source Code Repository (Unrelated Company Comment/Issue)
Company information exposed in comments or issues on unrelated repositories
System Exposure
Exposed systems and infrastructure accessible from external networks
- CTEM-EXP-1
Directly Connected Internal System
Internal systems directly accessible from external networks - CTEM-EXP-2
Remote Site Owned System (Presumed Connected)
Remote location systems presumed to be connected to corporate infrastructure - CTEM-EXP-3
Corporate Internet Exposed Gateway Device
Gateway devices and network infrastructure exposed to the internet - CTEM-EXP-4
Corporate Cloud Connected System
Cloud-hosted systems connected to corporate infrastructure - CTEM-EXP-5
Presumed Company System By Branding
Systems identified as corporate-owned based on branding or naming - CTEM-EXP-6
Contractor Or Vendor Managed System
Systems managed by contractors or vendors on behalf of the organization
Featured Examples
CTEM-INF-4: Infected Employee Device
Personal device using corporate identity for personal activities
Key Characteristics:
- Personal device owned by employee
- Corporate email used for personal services
- Established persistence by attackers
- Found in stealer logs or cybercrime forums
CTEM-RAN-1: Ransom Dump (Supplier)
Supplier data leaked via ransomware affecting organization
Key Characteristics:
- Supplier or vendor breach impact
- Public dumping of stolen data
- Indirect organizational exposure
- Supply chain risk amplification
Real-World Implementation
How organizations can use CTEM identifiers in practice
Security Operations Center (SOC)
Use CTEM identifiers to categorize and prioritize threat intelligence findings consistently across different security tools and platforms.
- Threat Intelligence
- Alert Classification
- Incident Response
Risk Management
Standardize risk assessment processes by using CTEM categories to ensure consistent evaluation of threats across the organization.
- Risk Assessment
- Compliance
- Reporting
Vendor Management
Evaluate and monitor third-party security posture using standardized CTEM identifiers for consistent supplier risk assessment.
- Third-party Risk
- Supplier Monitoring
- Contract Security
Project Timeline
Development milestones and roadmap
- October 2024
Project Launch
CTEM.org organization founded to develop threat exposure management standards - Q4 2024
Initial Taxonomy Development
Core identifier categories established for infected devices and ransomware incidents - Q1 2025
Community Expansion
Growing practitioner community and expanding taxonomy coverage - Q2 2025
Industry Adoption
Partner with organizations to implement CTEM standards in production environments