Introduction
Vulnerability Management has served the industry well for decades, but vulnerability counts alone no longer provide an accurate view of cyber risk.
As attack cycles compress and disclosure-to-exploitation timelines continue to shrink, security leaders must focus on understanding what is actually exposed, exploitable, and consequential to the business.
My latest thoughts on why Continuous Threat Exposure Management (CTEM) represents the next evolution of vulnerability management.
The challenge facing security leaders today is not simply identifying vulnerable assets. Most enterprises already possess more vulnerability data than they can reasonably act upon. The real challenge is reducing the window between vulnerability disclosure and effective risk reduction. As attack cycles compress and weaponization timelines shrink from weeks to hours, organizations require a capability to rapidly contain exposure even when permanent remediation is not immediately available.
Continuous Threat Exposure Management begins where traditional Vulnerability Management ends. Vulnerability Management identifies what is potentially vulnerable. CTEM determines what is exposed, exploitable, reachable and consequential to the business.
As the threat surface and vulnerability universe change dramatically, the framework for rapidly containing and blocking malicious threat actors becomes increasingly critical to business resilience and the deployment of pre-emptive countermeasures. More importantly, where patches are not available, virtual patching may be the most important and widely available control, depending on the attack-surface domain.
Organizations should strive to ensure that every internet-exploitable critical vulnerability has an actionable containment path capable of materially reducing exploitation risk before permanent remediation can be completed.
Security programs have historically measured success through vulnerability closure rates and patch compliance. Those metrics remain important, but they do not accurately represent organizational risk. A vulnerability that exists but is unreachable, isolated and protected by effective controls carries fundamentally different risk than one directly exposed to the internet.
The future of cybersecurity leadership will be defined by an organization's ability to reduce exploitable exposure rather than simply count vulnerabilities.
Virtual patching and the exploit path
OWASP defines virtual patching as an enforcement layer that detects and blocks exploitation of a known vulnerability without changing the vulnerable code.
The underlying principle is not to map a vulnerability to a security product merely based on what is vulnerable. Instead, the mapping should follow:
Expanded to include virtual patching and the full lifecycle, the model becomes:
The enforcement point or control depends on how exploitation reaches the vulnerable component. To operationalize this concept, I propose a Cyber Exposure Enforcement Model (CEEM) consisting of five exposure layers that collectively represent the vast majority of externally exploitable attack surfaces:
- Network & Edge
- OS & Infrastructure
- Middleware, Libraries & Containers
- Applications & APIs
- Identity & Cloud Services
Enforcement technology for each layer may be different because there is no universal virtual-patching mechanism that covers all exposure layers.
1. Network & Edge
For the Network & Edge layer, virtual-patching mechanisms most commonly include firewalls, intrusion prevention systems and vendor threat signatures. At this layer, the objective is to address network protocol exploits, malformed traffic, exploit signatures and access to vulnerable services.
2. OS & Infrastructure
For the OS & Infrastructure layer, virtual-patching mechanisms may consist of IPS, network isolation and host controls. If exploitation arrives through the network, enforcement can potentially be placed upstream of the vulnerable host. Network-level virtual patching works by intercepting the exploit vector before vulnerable code processes it.
The caveat is that not every operating-system vulnerability is virtually patchable using this method. A local privilege-escalation vulnerability, for example, may provide nothing meaningful for an internet-facing IPS or WAF to block. Emergency mitigation may instead require restricting service exposure, isolating the server or deploying host-level protection such as EDR prevention. These are compensating controls rather than virtual patches.
3. Middleware, Libraries & Containers
The enforcement point depends on how exploitation reaches the vulnerable component. Potential components include PHP, Java, Spring, Log4j, Apache, NGINX, OpenSSL, Node.js and container images.
If a critical PHP remote-code-execution vulnerability appears and no patch is available, and the attacker must exploit it through an HTTP interface, the path may look like this:
In this scenario, a WAF rule can reject malicious requests while the underlying PHP component remains vulnerable. The attacker cannot exercise that exploit path through the protected HTTP interface.
However, a PHP vulnerability does not automatically equal “WAF.” If exploitation is delivered through HTTP and is recognizable, a WAF may be highly effective. If exploitation is local, or malicious traffic is indistinguishable from legitimate traffic, a WAF may provide little or no protection. Virtual patches reduce exposure only for inspected traffic and attack variants recognized by their rules.
Containers are more complex because the vulnerable component may exist along a path such as:
Container virtual patching is therefore not a single control. If a vulnerable workload is exploited over HTTP, a WAF or WAAP control may shield it. If the vulnerability affects a network service, IPS or other network controls may be required. If it is a local container escape or host-kernel vulnerability, perimeter virtual patching may offer little or no protection.
4. Applications & APIs
For the Applications & APIs layer, WAF and WAAP are often the strongest controls. Organizations need the capability to rapidly deploy compensating WAF rules across affected internet-facing applications when a CVE or zero-day is disclosed. A virtual patch can constrain attributes such as the requested endpoint, HTTP method, parameters, headers or request body.
5. Identity & Cloud Services
For Identity & Cloud Services, compensating controls often involve conditional access policies, privilege restrictions, session controls, identity-protection capabilities, cloud-native security controls and rapid removal of exposed permissions rather than traditional network-centric virtual patching.
The role of Agentic AI
Agentic AI is likely to become the orchestration layer that enables CTEM at enterprise scale, transforming today's largely manual workflow of discovery, prioritization, containment and remediation into a continuously operating exposure-reduction system.
Across the CEEM layers, the challenge is not simply discovering a zero-day. The challenge is rapidly determining what is exposed, how it can be exploited and where that exploit can be stopped.
Agentic AI frameworks such as Microsoft's Project Perception demonstrate the direction of travel: red agents expose weaknesses, blue agents investigate risk and green agents remediate and harden defenses in a coordinated system. Pairing AI reasoning and orchestration with deterministic enforcement, including IPS, WAF/WAAP, isolation controls, RASP, EDR and virtual patching, could enable virtual patching to evolve from manually authored emergency rules into an increasingly autonomous, closed-loop defense capability, with humans governing critical actions and permanent patching remaining the ultimate remediation.
From vulnerability counting to exposure reduction
Vulnerability Management told us what was vulnerable. Continuous Threat Exposure Management must tell us what can actually be attacked, how an attacker can reach it and how quickly we can remove that opportunity.
That shift brings vulnerability data together with external exposure, threat intelligence, exploitability, attack paths and controls such as WAF/WAAP, IPS, RASP, segmentation and identity protections. As Agentic AI matures, it can become the orchestration layer connecting these capabilities, helping defenders move from find, ticket and patch toward discover, validate, protect and permanently remediate.
Success should ultimately be measured not by the number of vulnerabilities closed, but by the amount of exploitable attack surface eliminated, the speed at which exposure is contained and the organization's ability to remain resilient while permanent remediation is underway. That is the promise of Continuous Threat Exposure Management: shifting cybersecurity from vulnerability counting to exposure reduction.
Organizations that continue to measure cybersecurity primarily through vulnerability counts will increasingly find themselves overwhelmed by scale and speed. Organizations that understand exposure, exploitability and containment will be better positioned to build resilient security programs capable of adapting to an increasingly dynamic threat landscape.
Sun Tzu