# CTEM.org

**Continuous Threat Exposure Management Standards Organization**

Developing vendor-neutral standards and taxonomies for Continuous Threat Exposure Management (CTEM) to simplify adoption and ensure consistency across cybersecurity products and organizations.

Started October 2024  
Active Development  
Open Community

### What is Continuous Threat Exposure Management?

CTEM is a framework designed to reduce an organization's exposure to cyber threats through a continuous cycle of identification, assessment, and mitigation of risks in real time.

1. **Scoping**  
2. **Discovery**  
3. **Prioritization**  
4. **Validation**  
5. **Mobilization**

### Vendor-Neutral Standards

Develop unbiased, vendor-neutral approaches to CTEM ensuring consistency across products and organizations

### Standardized Identifiers

Categorize threat types with standardized identifiers for consistent threat classification

### Community-Driven

Collaborate with CTEM practitioners to develop practical, real-world applicable standards

### Simplified Adoption

Make CTEM adoption easier through clear documentation and standardized processes

### Project Objectives

What CTEM.org aims to achieve in the cybersecurity landscape

#### Standardize CTEM Practices

Create consistent, industry-wide standards for threat exposure management

#### Develop Threat Taxonomies

Build comprehensive categorization systems for security findings and threats

#### Foster Community Collaboration

Bring together CTEM practitioners to share knowledge and best practices

#### Simplify CTEM Adoption

Reduce barriers to implementing effective threat exposure management programs

### CTEM Identifier Categories

Complete standardized categorization system for threat exposure management findings from the official [CTEM.org documentation](https://ctem.org/docs/)

#### Complete Framework

This section includes all 8 categories and 28 identifiers from the official CTEM.org taxonomy. The identifiers are continuously refined based on community input and real-world implementation.

### Brand Impersonation

Counterfeit products and unauthorized use of corporate branding

- **CTEM-BND-1**  
  ##### Counterfeit Product Offered For Sale Or Use  
  Fake products using corporate branding offered for sale or distribution

### Credential Dump

Exposed credentials found in data breaches and dumps

- **CTEM-DAT-1**  
  ##### Credentials Leaked With Hostname  
  Corporate credentials exposed in data breaches with associated hostnames  
- **CTEM-DAT-2**  
  ##### Vendor System Dump With Credentials Offered Privately  
  Vendor system dumps containing credentials offered in private channels

### Financial Information Exposure

Exposed financial and sensitive business information

- **CTEM-FIN-1**  
  ##### Corporate Bank Account Routing Information Exposed  
  Banking routing information and account details exposed publicly  
- **CTEM-FIN-2**  
  ##### Accounts Payable Information Exposure  
  Accounts payable data and vendor payment information exposed

### Infected Device

Compromised devices across different ownership models

- **CTEM-INF-1**  
  ##### Infected Corporate Owned Device  
  Corporate-managed devices compromised by malware  
- **CTEM-INF-2**  
  ##### Infected Vendor Owned Device  
  Vendor or partner devices compromised and potentially affecting the organization  
- **CTEM-INF-3**  
  ##### Infected Employee Owned Device (Corporate Credentials)  
  Personal devices compromised while containing corporate credentials  
- **CTEM-INF-4**  
  ##### Infected Employee Owned Device (Personal Use of Corporate Identity)  
  Personal devices using corporate credentials for non-work activities  
- **CTEM-INF-5**  
  ##### Infected Customer Owned Device  
  Customer devices compromised that may impact organizational security  
- **CTEM-INF-6**  
  ##### Infected Employee Owned Device (Internal Network Connected)  
  Personal devices connected to corporate network infrastructure  
- **CTEM-INF-7**  
  ##### Infected Employee Owned Device (3rd Party Business Use of Corporate Identity)  
  Personal devices using corporate identity for third-party business activities

### Lookalike Domains

Domains created to impersonate or confuse with legitimate corporate domains

- **CTEM-DOM-1**  
  ##### Typo Squatted Domain  
  Domains registered with common misspellings of corporate domains  
- **CTEM-DOM-2**  
  ##### Homoglyph Attack Domain  
  Domains using visually similar characters to impersonate legitimate domains  
- **CTEM-DOM-3**  
  ##### Phishing Indicator Domain  
  Domains showing indicators of being used for phishing campaigns  
- **CTEM-DOM-4**  
  ##### Brand Impersonation Domain  
  Domains created to impersonate corporate branding and identity

### Ransomware

Ransomware attacks affecting organizational assets

- **CTEM-RAN-1**  
  ##### Ransom Dump (Supplier)  
  Supplier data leaked via ransomware affecting organization  
- **CTEM-RAN-2**  
  ##### Ransom Dump (Customer)  
  Customer data exposed through ransomware incidents

### Source Code Exposure

Exposed source code repositories and development artifacts

- **CTEM-SRC-1**  
  ##### Public Source Code Repository (Company Sanctioned)  
  Official company repositories with potential security exposures  
- **CTEM-SRC-2**  
  ##### Public Source Code Repository (Employee Created)  
  Employee-created repositories containing corporate code or data  
- **CTEM-SRC-3**  
  ##### Public Source Code Repository (Vendor Owned)  
  Vendor repositories containing code related to the organization  
- **CTEM-SRC-4**  
  ##### Public Source Code Repository (Unrelated 3rd Party)  
  Third-party repositories containing organizational references or code  
- **CTEM-SRC-5**  
  ##### Public Source Code Repository (Unrelated Company Comment/Issue)  
  Company information exposed in comments or issues on unrelated repositories

### System Exposure

Exposed systems and infrastructure accessible from external networks

- **CTEM-EXP-1**  
  ##### Directly Connected Internal System  
  Internal systems directly accessible from external networks  
- **CTEM-EXP-2**  
  ##### Remote Site Owned System (Presumed Connected)  
  Remote location systems presumed to be connected to corporate infrastructure  
- **CTEM-EXP-3**  
  ##### Corporate Internet Exposed Gateway Device  
  Gateway devices and network infrastructure exposed to the internet  
- **CTEM-EXP-4**  
  ##### Corporate Cloud Connected System  
  Cloud-hosted systems connected to corporate infrastructure  
- **CTEM-EXP-5**  
  ##### Presumed Company System By Branding  
  Systems identified as corporate-owned based on branding or naming  
- **CTEM-EXP-6**  
  ##### Contractor Or Vendor Managed System  
  Systems managed by contractors or vendors on behalf of the organization

### Featured Examples

#### CTEM-INF-4: Infected Employee Device

Personal device using corporate identity for personal activities

#### Key Characteristics:

- Personal device owned by employee  
- Corporate email used for personal services  
- Established persistence by attackers  
- Found in stealer logs or cybercrime forums

[View Full Documentation](https://ctem.org/docs/infection/ctem-inf-4-infected-employee-owned-device-personal-use-of-corporate-identity)

#### CTEM-RAN-1: Ransom Dump (Supplier)

Supplier data leaked via ransomware affecting organization

#### Key Characteristics:

- Supplier or vendor breach impact  
- Public dumping of stolen data  
- Indirect organizational exposure  
- Supply chain risk amplification

[View Full Documentation](https://ctem.org/docs/ransomware/ctem-ran-1-ransom-dump-supplier)

### Real-World Implementation

How organizations can use CTEM identifiers in practice

#### Security Operations Center (SOC)

Use CTEM identifiers to categorize and prioritize threat intelligence findings consistently across different security tools and platforms.

- Threat Intelligence  
- Alert Classification  
- Incident Response

#### Risk Management

Standardize risk assessment processes by using CTEM categories to ensure consistent evaluation of threats across the organization.

- Risk Assessment  
- Compliance  
- Reporting

#### Vendor Management

Evaluate and monitor third-party security posture using standardized CTEM identifiers for consistent supplier risk assessment.

- Third-party Risk  
- Supplier Monitoring  
- Contract Security

### Project Timeline

Development milestones and roadmap

- **October 2024**  
  #### Project Launch  
  CTEM.org organization founded to develop threat exposure management standards  
- **Q4 2024**  
  #### Initial Taxonomy Development  
  Core identifier categories established for infected devices and ransomware incidents  
- **Q1 2025**  
  #### Community Expansion  
  Growing practitioner community and expanding taxonomy coverage  
- **Q2 2025**  
  #### Industry Adoption  
  Partner with organizations to implement CTEM standards in production environments