The validation chain
By the time a finding carries a severity, it has earned it: detected, corroborated across multiple engines, adversarially probed, assigned a state.
Platforms / Continuous Threat Exposure Management
Proof-driven CTEM: from discovery to validated fix
Most exposure programs drown in their own scanner output: thousands of findings, no proof, and senior engineers triaging spreadsheets instead of fixing risk. VirtueThreatX runs all five Gartner CTEM stages in one workflow and adds the step the industry skips, adversarial validation, so what reaches your team is proven exploitable and worth the interruption. AI and LLM exposure is covered as a first-class attack surface.
- All 5 Gartner CTEM stages in one workflow
- 49 detection engines across 10 attack surfaces
- Adversarial validation: proven exploitable, not theoretical
- Frameworks: MITRE ATT&CK · OWASP · CISA KEV · EPSS · NIST CSF · PCI DSS · SOC 2
The validation chain: how every finding earns its label
Detection only opens the question. A finding is corroborated across engines, adversarially probed, then assigned one of four honest states. Only proven-exploitable exposures reach your engineers, which is what makes the number you report upward defensible.
- 01
Detection
A candidate finding enters the pipeline.
- 02
Corroboration
Cross-engine agreement separates signal from noise.
- 03
Adversarial probe
A production-safe probe proves exploitability.
- 04
State assignment
The finding earns one of four honest states.
Only one state wakes your team
Validated
Proven exploitable; pages on-call with evidence
Validating
In active adversarial probe
Theoretical
Real, but not reachable
Suppressed
Audit trail only
The five CTEM stages, as one loop
01
Scope
Define the estate that matters: the assets, apps, and surfaces where exposure carries business risk.
02
Discover
Seedless external attack-surface discovery finds every asset, subdomain, certificate, and shadow service exposed to the internet.
03
Prioritize
Rank by real risk, weighing KEV status, EPSS, and business context over raw CVSS severity.
04
Validate
Adversarial, production-safe probing proves what is actually exploitable, the stage most platforms skip.
05
Mobilize
Validated exposures open tickets with an owner and SLA, trigger response, and are tracked to a proven fix. Then the loop starts again.
Capabilities
Four honest states
Validated (proven exploitable; pages on-call with evidence), Validating (in active probe), Theoretical (real but not reachable), Suppressed (audit trail only). Only Validated wakes your team.
Surface-aware scanning
The right scanner goes only to the surfaces where it applies, including web, API, cloud, identity, and AI/LLM. Higher signal, lower cost.
AI & LLM exposure, built first
Prompt-injection probing, RAG context fuzzing, shadow-AI discovery, and model-exposure scanning. The attack surface most exposure tools don't cover at all.
Re-scans only what changed
Re-scans fire on the events that change risk (code pushes, new KEV entries, certificate-transparency logs, cloud changes), and each run reports only what's new.
Identity exposure management
Over-permissioned roles, leaked credentials, non-human identity sprawl, and IAM relationship walks: the identity attack paths behind most modern breaches.
Architecture
How it's built
One validation pipeline runs under every engine: detection, corroboration, and adversarial proof share a single evidence trail from first hit to fix.
Discover
External attack surface management
Seedless discovery maps everything internet-exposed (assets, subdomains, certificates, shadow services) and monitors it for drift.
Detect
Engines dispatched by capability
Continuous, event-driven scanning across ten attack surfaces, including web, API, cloud, identity, and AI/LLM: the right engine on the right target, with findings corroborated across engines to separate signal from noise.
Validate
Adversarial exposure validation
Production-safe adversarial probing (BAS) plus LLM triage and KEV cross-reference prove exploitability before a finding ever reaches your queue: the platform's defining step.
Mobilize
Owner, SLA, response & retest
Validated exposures auto-open tickets with an owner and SLA, integrate with security operations, and are re-validated on change until proven fixed.
Integrations
- Scanning coverage
- Dedicated detection engines per surface: Web, API, Cloud, Identity, AI/LLM, and more
- Risk-change triggers
- Git pushes, CISA KEV entries, certificate-transparency logs, CloudTrail, Kubernetes admission
- Frameworks & prioritization
- MITRE ATT&CK, OWASP Top 10, CISA KEV, EPSS, NIST CSF, PCI DSS, SOC 2
Deployment & data
Runs as a continuous exposure-management service alongside our assessment engagements. Adversarial validation is production-safe by design; scope, scan cadence, and data handling are agreed at engagement start, and findings are tenant-isolated.
Per-tenant data isolation; data-handling terms committed in your service agreement. See Trust & Company Facts.
Inside the platform
Real screens from a live demo tenant. Client data is redacted; the interface and data model are exactly what your team works in.
captured from a live demo tenant · client data redacted
captured from a live demo tenant · client data redacted
What the AI does, precisely
- Autonomous
- Discovery, surface-aware scanning, and delta re-scans on risk-changing events run continuously without human initiation.
- AI-assisted
- Prioritization, LLM-assisted triage, and the exploitation forecast are AI-driven; validation logic is engineer-designed.
- Human-decided
- What enters your queue, and any active adversarial validation against production, is governed by engineer supervision and production-safe guardrails.
In service delivery
VirtueThreatX powers our vulnerability assessment and continuous testing engagements, and in the assurance loop it's the ATTACK phase's proving ground: findings our red team and pentesters confirm become validated, tracked exposures. Your engineers receive tickets with an owner, evidence, and a retest, never a spreadsheet.
Vulnerability Assessment service →See it running
A guided session with the engineers who built the platform: how discovery, validation, and prioritization behave against a real attack surface, with your questions answered live.