Connect with us

Business & Technology

building a modern CTEM program

Published

on


Cybersecurity leaders aren’t struggling with visibility as much as they are with prioritisation.

With cloud-native apps, identity, SaaS, OT, and more, the attack surface today is much broader than the one traditional programs were designed to address. The consequence is all too familiar: thousands of alerts, disjointed insights, and still, no clear answer to what should be an obvious question: what matters most to the business today?

This is where exposure management and AI-driven exposure assessment enter the picture, with the operational model being Continuous Threat Exposure Management (CTEM).

Why CTEM matters

What problem is CTEM solving?

Traditional security tools are very good at identifying vulnerabilities, but not as good at identifying those vulnerabilities that are actually exploitable and have a significant impact. This issue has become more pronounced as the environment becomes more distributed and interconnected.

CTEM provides a new approach that is continuous and risk-based. It changes the paradigm from detection to exposure. Rather than relying on regular scans and scores that do not change over time, it’s all about the process of discovery, analysis, validation, and action.

At a high level, the benefits of CTEM are:

  • The ability to focus on what is actually reachable and exploitable
  • A way to focus on business risk rather than technical severity
  • Having continuous risk assessments as environments change

The fundamental shift is from “what is vulnerable?” to “what could actually be used against us?”

The five stages of a CTEM program

How do you operationalise exposure management?

CTEM is more of a lifecycle than a tool. Like any good lifecycle, it is iterative.

It begins with scoping. Here, businesses identify what matters most. What are critical assets? What are key business services? What are systems with financial or regulatory implications? Without scoping, prioritisation is soon noise.

Discovery is next, and it is far more complicated than it is made out to be. Environments are in motion. Assets are spinning up and down. Identities are changing. And new risks are emerging every day. Maintaining an inventory of what is in IT, in the cloud, and beyond is foundational.

Once exposures have been defined, prioritisation is the key challenge. This is where context is important. Prioritisation that is effective takes into account:

  • Exploit availability and attacker activity
  • Asset criticality and business function
  • Network exposure and identity access paths

This is where companies go beyond general severity ratings and into something much more actionable.

The fourth stage is validation. This is where realism is introduced. It answers whether this exposure is actually exploitable. This is done by examining attack paths and simulating attacks.

Lastly, there is mobilisation. This is where action is taken. It is where there is integration with workflows, assigning action items, and tracking progress in a measurable way.

Building unified exposure visibility across the attack surface

Why is visibility still such a challenge?

Most organisations have made significant investments in various tools, and the problem is that the visibility is fragmented. Cloud security, identity security, endpoint security, and network security are usually implemented in parallel and generate their own data and priorities.

The problem is that risks don’t exist in silos. Risks are the result of interactions.

Exposure visibility gives the ability to bring these domains together.

  • How are the vulnerabilities related between the environments
  • How does the identity and access provide unintended pathways
  • How does the combination of the weaknesses create real attack opportunities

For example, the configuration of the workload in the cloud could be considered low risk. However, when the permissions are excessive and the workload is exposed, the risk is more obvious.

The connections between the risks are not always obvious unless the cross-domain exposure is considered.

Continuous discovery across a dynamic attack surface

Why isn’t periodic scanning enough anymore?

Because the environment doesn’t sit still.

The nature of cloud-based workloads is ephemeral. Applications are constantly being updated. User roles and permissions are in constant flux. In this environment, periodic assessment is plagued by blind spots, where snapshots are obsolete almost as soon as they’re taken.

Continuous discovery solves this problem by providing real-time visibility into your environment. This is because we recognise that your attack surface is constantly changing, and your risk assessment must follow.

This is particularly critical in:

  • Cloud-native environments
  • Hybrid infrastructures
  • Businesses that are adopting risk-based cloud security models

With no continuous insight, entities are making decisions based on incomplete data.

Prioritising cyber risk with business context

How do you decide what to fix first?

It is in this area that security software often falls short, as the sheer number of vulnerabilities far outweighs the number of ways to address them.

It is in this area that organisations are increasingly turning to AI to help address the problem. It is able to do so by correlating data from different domains, to:

  • Identify potential paths of attack
  • Uncover vulnerabilities that are actively being exploited
  • Correlate technical risks to business risks

This is where the real value of such an approach comes in – not only is it more efficient, but it is also more understandable.

From vulnerability scans to continuous, contextualised exposure insight

What is the role of traditional vulnerability management today?

Vulnerability scanning is still a fundamental technique. Tools like Nessus are very good at finding known weaknesses, misconfigurations, and patch problems.

Scanning, however, is no longer sufficient on its own.

A scanner, by itself, will tell you what you have. It won’t tell you:

  • Is the vulnerability reachable?
  • How does it get exploited?
  • What are the business implications?

As part of a CTEM-based approach, vulnerability information becomes part of a larger model of exposure. It’s augmented, validated against “real world” scenarios, and weighted by relevance.

This is the evolution from simple data collection to decision support.

Integrating CTEM with existing security workflows

How do you make CTEM actionable?

Insight is useless if action is not taken. This is the biggest pitfall in the implementation of cybersecurity initiatives.

The operationalisation of CTEM is the integration of CTEM into existing workflows. This includes:

  • Integrating CTEM findings into existing IT and DevOps ticketing systems
  • Aligning remediation activities with business priorities and ownership
  • Measuring the effectiveness of remediation activities over time

Additionally, there is a need to change the way we communicate CTEM findings. This is so that the findings are communicated in a way that the business can understand.

The most successful organisations in the implementation of CTEM are those that treat the process as a shared responsibility.

The bigger shift: from reactive security to exposure reduction

Exposure management and AI-driven exposure assessment are a result of a larger shift in the world of Cybersecurity. They represent a shift from:

  • Alerts to insights
  • Volume to context
  • Technical severity to business risk
  • Periodic review to continuous assessment

This goes beyond a change in tools, to altering how we think about cyber risk.

Prioritisation will be the key differentiator

The attack surface will carry on expanding, and complexity will continue to rise. Therefore, in this environment, the ability to prioritise is going to be the key differentiator.

As organisations continue to mature their CTEM programs, they are no longer just trying to find problems. They are trying to gain a better understanding of their risk and be more proactive.

The key to success is not how many problems are discovered, but how well the risk is reduced.



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Business & Technology

Crypto group urges UK bank complaints over transfer bans

Published

on



KAREN JOY BACUDO

Finance Editor

Stand With Crypto UK has launched a campaign urging customers to file formal complaints against banks that block transfers to cryptocurrency exchanges. The group says it represents 286,000 advocates in the UK.

The campaign began with an installation at Reuters Plaza in Canary Wharf, where three large blocks of ice containing banknotes were displayed to symbolise money consumers can see but cannot access. Stand With Crypto UK is asking supporters to complain to their banks about what it describes as blanket restrictions on transfers to cryptoasset exchanges registered with the Financial Conduct Authority.

The move escalates a long-running dispute between parts of the banking sector and the crypto industry over fraud controls, consumer protection and access to digital asset markets. Stand With Crypto UK argues that many banks have imposed broad limits or outright bans regardless of the exchange involved or the individual customer’s risk profile.

Industry data cited by the group suggests the scale of those restrictions. The Locked Out report by the UK Cryptoassets Business Council, based on a survey of 10 of the UK’s largest crypto exchanges, found that 40% of all UK crypto transactions are either blocked or restricted by banks.

According to the same report, one exchange recorded nearly £1 billion in declined transactions in a single year due to bank-side rejections. Over the previous 12 months, 80% of surveyed exchanges reported a measurable increase in blocked or limited transfers.

The issue affects a market that already reaches a notable share of the population. Financial Conduct Authority consumer research found that around 8% of UK adults currently hold cryptoassets, giving the dispute significance beyond specialist trading circles.

Consumer pressure

Rather than relying solely on regulatory lobbying, the campaign aims to apply direct pressure through bank complaint procedures. Stand With Crypto UK says banks’ responses will help determine its next steps.

The organisation says its supporters include consumers, business owners, entrepreneurs and investors who want to move their own money to legal trading venues. It argues that broad bank restrictions amount to one-size-fits-all policies in a sector where the exchanges involved are already registered with the UK regulator.

“People across the UK are being blocked from accessing a legal asset class because banks have chosen to impose blanket restrictions on an entire sector. Stand With Crypto’s 286,000 UK advocates are ordinary people, business owners, entrepreneurs and investors. From today, they are formally telling their banks that these restrictions are unacceptable and that consumers should be treated as individuals, not subjected to one-size-fits-all policies,” said Adriana Ennab, Director, Stand With Crypto UK.

The complaint drive also reflects a broader industry argument that banking policy is misaligned with the UK’s stated ambition to support digital asset activity. Crypto companies have long argued that access to basic payment rails remains one of the biggest barriers to retail participation.

Coinbase, which backs Stand With Crypto, framed the issue in terms of both national policy and customer access. The exchange has been among the companies pressing for clearer rules and more consistent treatment from financial institutions.

“The Government has set out a vision to make the UK a global hub for digital assets and Web3. That vision requires retail participation, where everyday people hold and engage with cryptoassets. But banks are choking off the crucial on-ramp from fiat money into crypto. They are putting the Government’s digital asset ambitions at risk at a time when the global race for digital assets is intensifying,” said Katie Harries, Head of Policy, Europe, Coinbase.

Bank tensions

Relations between banks and crypto businesses in the UK have been strained for several years. Lenders have tightened controls in response to concerns about scams, money-laundering risks, and operational exposure, while crypto firms argue that the response has become too broad and can ensnare legitimate transactions.

Stand With Crypto UK also argues that some financial institutions are taking contradictory positions. It says banks that restrict customer payments to crypto exchanges are also building digital asset teams and exploring their own products in the market.

That criticism reflects a broader competitive debate in financial services. Campaigners argue that if customers are prevented from using regulated channels to access crypto markets, they may be shut out of a legal part of the financial system while institutions remain free to pursue their own commercial strategies in the same area.

The campaign will not by itself change bank policy, but it could generate a substantial volume of customer complaints if even a fraction of the group’s claimed membership takes part. For banks, that could mean having to justify retail crypto restrictions in greater detail to customers who are increasingly familiar with digital assets and may question whether blanket blocks remain proportionate.



Source link

Continue Reading

Business & Technology

Oxford business wins award for its apprentice support

Published

on



Haysham Ltd, based in Oxford, was named a regional winner in the JTL 2026 Employer Recognition Awards at Plaisterer’s Hall in London.

The awards celebrate employers who excel in training and developing future talent in the building services engineering sector.

Adam Bolley, director at Haysham Ltd, said: “We’re delighted to receive this recognition from JTL.

“Investing in apprentices is an important part of how we build skills for the future, and JTL’s training support helps ensure our apprentices gain the knowledge, confidence and practical experience they need to thrive in the industry.”

Haysham Ltd was selected from more than 3,800 businesses that partner with JTL across England and Wales.

JTL described Haysham’s commitment to nurturing the next generation of skilled professionals as outstanding.

The national apprenticeship awards also honour exceptional apprentices, tutors and training professionals across England and Wales.

Chris Claydon, chief executive of JTL, said: “Delivering high-quality apprenticeships is always a shared effort, and our Employer Recognition Awards are about celebrating the vital role employers play in making that possible.

“The businesses recognised have shown outstanding commitment to supporting, mentoring and investing in apprentices, helping to create the skilled, confident workforce our industry needs for the future.”

JTL currently supports around 8,000 learners across the UK in the electrical and mechanical engineering services sectors.





Source link

Continue Reading

Business & Technology

UK retail investors top up accounts ahead of SpaceX

Published

on




KAREN JOY BACUDO

Finance Editor

UK retail investors increased top-ups to investment accounts by 27% ahead of SpaceX’s Nasdaq listing, according to TrueLayer data, pointing to stronger retail trading activity in the run-up to the share sale.

The London-based payments group recorded the increase across its trading and investment platforms over the past two weeks. It compared average top-up volumes with the previous two-week period and with longer baselines across 2026.

The same pattern did not appear in its other business segments during that period. Reviews of its iGaming and eCommerce data showed no similar rise, suggesting the increase was concentrated in financial services.

TrueLayer processes Pay By Bank transactions for a range of UK investment and trading platforms, giving it visibility into when retail customers move money into brokerage and investment accounts. It said this can provide an early indication of investor activity before it appears in broader market data.

SpaceX is expected to begin trading on Nasdaq under the ticker SPCX at a fixed offer price of USD $135 per share. At that price, it would be valued at about USD $1.75 trillion, making the flotation the largest initial public offering on record.

The listing has drawn attention because of the share allocation set aside for individual investors. TrueLayer said SpaceX had earmarked up to 30% of the offering for retail buyers, compared with about 10% typically seen in large IPOs dominated by institutions.

Retail interest

The data offers a snapshot of how UK consumers are preparing to take part in a major US listing. By topping up accounts before trading begins, retail investors can position themselves to apply for shares or buy stock once the company starts trading publicly.

Payment flows into investment platforms have become a useful signal for market watchers during periods of intense retail interest. Spikes in account funding can indicate that private investors are responding to high-profile flotations, volatile trading conditions or broader shifts in sentiment.

TrueLayer’s figure was based on anonymised, aggregated payment information from its network. The 27% rise reflected average pay-in volumes across its financial services segment over the two weeks to 11 June, compared with the preceding fortnight.

Longer-range comparisons showed an even larger increase, but the company used the shorter period as a more conservative measure because payment volumes have trended upwards over time.

“Retail investors are getting their accounts ready, and we can see it on the payment rails. Top-ups to investment platforms and retail brokers are up 27 percent, which tracks closely with the surge of retail interest around the SpaceX IPO,” Francesco Simoneschi, Chief Executive Officer and Co-Founder of TrueLayer, said.

Payments view

Founded in London in 2016, TrueLayer operates across 22 countries and says more than 25 million users rely on its network for transactions. Its service is used by businesses to collect bank payments, move funds and verify account information.

Because it sits between consumers’ bank accounts and a range of merchants, the company can track broad patterns in how money moves between sectors. In this case, the increase appeared specific to investment-related activity rather than a wider lift in consumer payments.

That distinction matters because a general rise across multiple sectors could reflect payday patterns, seasonal spending or other external factors. The absence of a comparable increase in eCommerce and iGaming suggests investors were moving money with a specific purpose tied to the listing.

The scale of the SpaceX flotation has drawn unusual attention to the role of retail demand. A large allocation to individual investors means consumer appetite may play a more visible part in early trading than in many previous blockbuster IPOs.

For brokers and payment providers, this creates an opportunity to gauge activity before orders appear in market data. TrueLayer’s figures suggest that, at least among UK retail investors using pay-by-bank transfers, preparations to participate were already underway before the first trade.

Shares are expected to trade at a valuation of roughly USD $1.75 trillion.



Source link

Continue Reading

Trending