I had the dignity of internet hosting the primary episode of the Xposure Podcast reside from Xposure Summit 2025. And I could not have requested for a greater kickoff panel: three cybersecurity leaders who do not simply speak safety, they reside it.
Let me introduce them.
Alex Delay, CISO at IDB Financial institution, is aware of what it means to defend a extremely regulated setting. Ben Mead, Director of Cybersecurity at Avidity Biosciences, brings a forward-thinking safety perspective that displays the innovation behind Avidity’s focused RNA therapeutics. Final however not least, Michael Francess, Director of Cybersecurity Superior Risk at Wyndham Resorts and Resorts, leads the cost in defending the franchise. Every introduced a novel vantage level to a typical problem: making use of Steady Risk Publicity Administration (CTEM) to complicated manufacturing environments.
Gartner made waves in 2023 with a daring prediction: organizations that prioritize CTEM will probably be 3 times much less seemingly to be breached by 2026. However this is the kicker – provided that it is operationalized.
Talking with these seasoned defenders, we unpacked the realities and challenges behind the hype of implementing and operationalizing an efficient Publicity Administration technique, addressing the next robust questions:
- What does a superb CTEM program seem like and what are the standard challenges that should be overcome?
- How do you optimize cyber and danger reporting to affect board-level choices?
- And finally, how do you measure the success of your CTEM program?
Challenges, Priorities, and Greatest Practices
CTEM is not plug-and-play. The panelists’ prescription was clear: begin with asset stock and id administration; weak service accounts, over-permissioned customers, legacy logins. None of those are small gaps, they’re wide-open doorways that should be checked continuously. And for all of our panelists, frequency issues – rather a lot. As a result of guess what? Adversaries are consistently difficult defenses too. For inner belongings, weekly validation is the rule of thumb. For external-facing belongings? Each day. As they see it, it is the one technique to keep a continuing deal with over their consistently altering environments.
Surprisingly, Michael pointed to risk intelligence because the spine of any safety testing program. “It is advisable to perceive your adversaries, simulate their TTPs, and take a look at your defenses in opposition to real-world eventualities, not simply patching CVEs.” That is the important thing distinction between CTEM and vulnerability administration. Vulnerability administration is about patching. Publicity administration is about determining whether or not your controls truly work to dam threats.
Reporting: Translating Cyber to Threat Phrases
Within the banking trade, like many different extremely regulated industries, Alex could not emphasize sufficient the should be ready to reply arduous questions requested from regulators. “You will get challenged in your publicity, your remediation timelines, and your danger remedy. And that is a superb factor. It forces readability and accountability”.
However even outdoors regulated industries, the dialog is altering. Boards don’t need to hear about CVSS scores. They need to perceive danger – and that is a very completely different dialogue. Is the corporate’s danger profile going up or down? The place is it concentrated? And what are we doing about it?
Measuring Progress
Success in CTEM is not about counting vulnerabilities; Ben pinned it down when he mentioned he measures the variety of exploited assault paths his staff has closed. He shared how validating assault paths revealed dangerous safety gaps, like over-permissioned accounts and forgotten belongings. Instantly, danger turns into seen.
Others took it in one other path with tabletop workouts that stroll management by means of actual
assault eventualities. It is not about metrics, it is about explaining the chance and the results. A shift that strikes the dialogue from noise to sign, and offers the enterprise readability on what issues: the place we’re uncovered, and what we’re doing about it.
From Idea to Motion
Need to hear how these defenders are placing CTEM into motion with out drowning in noise?
This episode dives deep into the actual questions: the place do you begin, how do you keep targeted on what’s exploitable, and the way do you join all of it to enterprise danger? You may hear first-hand how safety leaders like Alex, Ben, and Michael are tackling these challenges head-on, with a number of surprises alongside the best way…
🎧Be sure to catch the complete dialog on Apple Podcast and Spotify
