AEV and CTEM: How Do They Work Together?

Lena Fuks

October 14, 2026

Guide

Continuous threat exposure management (CTEM) is a five-stage program. Adversarial exposure validation (AEV) is the technology category that delivers its validation stage. CTEM tells an organization what process to run. AEV supplies the evidence that makes one stage of that process trustworthy.

Gartner introduced CTEM in 2022 and published its first Market Guide for Adversarial Exposure Validation on 11 March 2025. The two are designed to be used together.

What Are the Five CTEM Stages?

The stages are scoping, discovery, prioritization, validation and mobilization. Many vendors claiming CTEM cover the first three and stop. The last two are where exposure management either produces results or stalls.

The full model is in What Is Continuous Threat Exposure Management and CTEM framework stages.

What Does AEV Do at Each Stage?

CTEM stage	What happens	Role of AEV
Scoping	Define which assets and risks matter	Indirect: validated results show which scope choices carry real exposure
Discovery	Find assets and exposures	Consumes discovery output as the list of targets to test
Prioritization	Rank what to fix	Replaces estimates with proof of exploitability
Validation	Confirm which exposures can be exploited	Core function: automated, continuous evidence of attack feasibility
Mobilization	Drive fixes across teams	Supplies reproducible evidence, then retests the fix

Why Does Validation Change Prioritization?

Without validation, prioritization depends on severity scores and guesses about context. That produces long queues where the truly dangerous items are mixed with ones that cannot be reached or are already blocked. Teams then spend time arguing about findings instead of fixing them.

With validation, the queue changes. Exposures proven exploitable move to the top, and unconfirmed ones drop away. Engineers receive evidence they can reproduce, which shortens the path from finding to fix.

See how this differs from traditional vulnerability management in CTEM vs vulnerability management.

What Mistakes Do Teams Make With AEV in CTEM?

Treating validation as an annual event: A yearly test cannot keep up with a surface that changes daily. Validation has to be continuous.
Validating without discovery: Testing only known assets leaves unknown ones untested. Discovery has to feed validation.
Skipping the retest: A fix is not done until the exposure is retested and shown to be closed.
Accepting scores as proof: A risk score is an estimate. Proof is a reproducible result.
Stopping at the report: Validated findings only matter when they reach the people who can fix them.

For the discovery side, see unknown asset discovery and the EASM pillar.

Which Metrics Show That AEV Is Working?

Share of findings validated: The percentage of reported exposures with proof of exploitability.
False positive rate: How often a reported finding turns out not to be exploitable.
Alert volume: The reduction in findings sent to engineering after validation.
Time to remediate: How quickly validated exposures are fixed.
Retest closure: The share of fixes confirmed by a retest.

How Does ULTRA RED Run the Loop?

ULTRA RED is a validation-first CTEM platform and an AEV platform, built as one continuous loop. It discovers the external attack surface from a single domain, scans continuously, validates every finding with a working proof of concept, and routes results to the teams that fix them. A validate-now retest confirms each fix.

CRIMSON handles remediation, and H1VE captures what real attackers are doing so the scanners test for those exact methods. The loop restarts each cycle, so validation never becomes a one-time event.

Explore the ULTRA RED platform or book a demo to see validated exposures on your own attack surface.