Beyond the Scan: CTEM as a Maturity Leap for Australian Enterprises

Most Australian enterprises can produce a vulnerability report on demand. Scanners run on schedule, dashboards refresh, and the count of critical findings has become a familiar line in the monthly security pack. What far fewer organisations can produce is a confident answer to the questions that actually decide whether a breach happens: which of those findings an attacker could use against this environment right now, which ones should be fixed first, and whether last month’s fixes are still holding.

That distance between knowing and acting is where most of the risk now sits. It is also where Continuous Threat Exposure Management (CTEM) earns its place. CTEM is often discussed as if it were a product category. It is more useful to treat it as a maturity posture: a way of running exposure reduction as a continuous programme instead of a periodic event, so that security teams stop reacting to what has already been exploited and start removing the conditions attackers depend on.

Key Takeaways

Most Australian enterprises can identify vulnerabilities; far fewer can say which ones are exploitable in their environment, which to fix first, and whether fixes held
Exploitation windows have shrunk to days, so a remediation process that runs slower than the attacker’s path from disclosure to exploitation leaves organisations exposed regardless of tooling
CTEM is a programme, not a product: a continuous cycle of scoping, discovery, prioritisation, validation and mobilisation with named owners and business-recognised measures
“Continuous” means a cycle that never stops and moves at the pace the exposure surface changes, made sustainable through automation, agreed prioritisation rules and event-driven validation
For critical infrastructure operators, the 2026 Enhanced CIRMP Rules make unpatched systems and legacy technology an explicit risk category, and a working CTEM programme produces the evidence boards need

The gap where breaches live

The pressure on that gap has increased sharply over the past year. Rapid7’s latest research found that confirmed exploitation of newly disclosed high and critical-severity vulnerabilities rose 105% in 2025, from 71 to 146 (Rapid7, 2026). Over the same period, the median time between a vulnerability’s publication and its addition to CISA’s Known Exploited Vulnerabilities catalogue fell from 8.5 days to 5.0 days (Rapid7, 2026). The buffer that once gave teams time to triage, test and schedule remediation is now measured in days.

The Australian picture is consistent. ASD’s Australian Cyber Security Centre reported that publicly reported vulnerabilities increased 28% in FY2024–25 (ASD, 2025), and that of the more than 120 incidents it observed involving attacks on edge devices, 96% were successful (ASD, 2025). The same report describes a major critical infrastructure provider that patched a vulnerable edge device after an ASD notification, then watched attackers attempt to exploit it within 48 hours (ASD, 2025). That organisation acted in time. The margin was two days.

None of these figures describe organisations without security tooling. They describe organisations where the path from finding to fixing is slower than the attacker’s path from disclosure to exploitation. More scanning does not close that gap on its own. A scan tells you what exists. It does not tell you what matters in your environment, who needs to act, or whether anything changed after they did.

CTEM is a programme, not a product

Gartner introduced CTEM in 2022 as a programme and strategic approach, not a specific product or solution (Gartner, cited in Cloud Security Alliance, 2024). That distinction matters in practice. Platforms are essential to CTEM, but deploying one does not create a CTEM programme. What creates the programme is a repeatable cycle with named owners, an agreed cadence and measures that the business recognises, running through five stages.

Scoping: start with what the business cannot afford to lose

Scoping is a business decision before it is a technical one. Instead of trying to cover the whole estate at once, a mature programme sets a bounded scope tied to a business outcome: the customer payments path, a plant’s control network, or the identity platform every other system trusts. Good scoping also reaches past the traditional asset register into SaaS tenants, code repositories, third-party connections and the service accounts that link them together. The first scope is usually narrower than teams expect, and that is a strength. A narrow scope that completes a full cycle teaches the organisation more than a broad one that stalls at discovery.

Discovery: see the environment the way an attacker would

Discovery maps every asset and exposure inside the scope, and exposure is broader than a CVE list. Misconfigurations, over-permissioned identities, exposed credentials and forgotten internet-facing services all count. Rapid7 found that valid accounts without multi-factor authentication were responsible for 43.9% of the incidents it investigated in 2025 (Rapid7, 2026), a reminder that some of the most heavily used exposures never appear in a patch report at all.

Prioritisation: rank by exploitability and business consequence

A severity score describes a vulnerability in the abstract. Prioritisation describes it in your environment. The factors that matter are evidence of active exploitation, whether the asset is reachable by an attacker, the asset’s role within the business scope, and whether compensating controls already break the attack path. The output should be a list short enough for an operations team to act on this week, with the reasoning attached.

Validation: prove the path before committing the effort

Validation tests whether a prioritised exposure is genuinely exploitable in context, and whether existing controls would detect or block the attempt. Penetration testing, attack simulation and red team exercises all have a role here. Validation also closes the loop after remediation. A ticket marked resolved and an exposure that has actually been removed are two different things, and only one of them reduces risk.

Mobilisation: turn findings into owned, agreed action

Mobilisation is where most programmes lose momentum, because it depends on people outside the security team. Infrastructure owners, application teams and business stakeholders need to agree what gets fixed, by whom and by when, and what happens when a fix cannot be applied in time. ASD’s guidance for network defenders frames the test well: organisations should be able to explain their process for patching or mitigating critical vulnerabilities in internet-facing network devices within 48 hours, and who owns each step (ASD, n.d.). Mobilisation is the discipline that makes that answer true on an ordinary Tuesday, not just in a policy document.

Evidence Snapshot

On the speed of exploitation
– Confirmed exploitation of newly disclosed high and critical-severity vulnerabilities rose 105% in 2025 (Rapid7, 2026)
– The median time from publication to inclusion in CISA’s Known Exploited Vulnerabilities catalogue fell from 8.5 days to 5.0 days (Rapid7, 2026)
– Valid accounts without multi-factor authentication were responsible for 43.9% of incidents Rapid7 investigated in 2025 (Rapid7, 2026)

On the Australian picture
– Of more than 120 incidents ASD observed involving attacks on edge devices in FY2024–25, 96% were successful (ASD, 2025)
– ASD notified critical infrastructure entities of potential malicious cyber activity more than 190 times in FY2024–25, up 111% on the previous year (ASD, 2025)

On the cost of time exposed
– The average cost of a data breach in Australia reached AUD $4.22 million (IBM, cited in SecurityBrief Australia, 2026)
– Breaches taking more than 200 days to identify and contain averaged AUD $5.17 million, against AUD $3.26 million for those contained in under 200 days (IBM, cited in SecurityBrief Australia, 2026)

What “continuous” means when the team is already stretched

When security leaders hear “continuous”, many hear “more work”, and that reaction is reasonable for teams already at capacity. In practice, continuous does not mean everything, all the time. It means the cycle never stops, and its cadence matches the rate at which the exposure surface changes.

That surface moves constantly. Monthly patch releases introduce and retire exposure on their own schedule. New cloud workloads appear in hours. Acquisitions bring networks that nobody in the security team designed. SaaS adoption and shadow IT add identities and integrations outside formal change processes. A quarterly assessment is a photograph of a moving target: accurate at the moment it is taken and increasingly wrong from then on.

Running the cycle continuously without exhausting the team comes down to design. Discovery and monitoring are automated. Prioritisation rules are agreed once with the business and applied consistently, so each new finding does not trigger a fresh negotiation. Validation becomes event-driven, triggered by a new known-exploited vulnerability, a significant change or a new asset entering scope, not by the annual testing calendar. Mobilisation runs against service levels anchored to ASD’s patching guidance, which calls for patching internet-facing services and network devices within 48 hours when a vulnerability is assessed as critical or a working exploit exists, and within two weeks otherwise (ASD, n.d.).

The measure of success shifts accordingly, from the number of findings closed to the length of time scoped assets remain exposed. The financial case for that shift is clear. The average cost of a data breach in Australia reached AUD $4.22 million (IBM, cited in SecurityBrief Australia, 2026), and Australian organisations that took more than 200 days to identify and contain a breach averaged AUD $5.17 million, compared with AUD $3.26 million for those that did it in under 200 days (IBM, cited in SecurityBrief Australia, 2026). Time exposed is time paid for.

Where the Orro and Rapid7 partnership fits

Rapid7 is Orro’s CTEM delivery partner, and Orro was named Rapid7’s APJ Partner of the Year for 2026 (Rapid7, 2026). The partnership brings together two capabilities that are each necessary and neither sufficient on its own.

Rapid7’s Command Platform provides the exposure visibility, threat intelligence and prioritisation engine at the core of the programme, and it works alongside the security tools an organisation already runs instead of replacing them. Orro provides the operating model around it. That includes scoping workshops that bring business stakeholders into the first stage, analysts in Orro’s National Cyber Defence Centre who interpret and validate findings, remediation guidance written for the operations teams who have to carry it out, and ongoing assurance that fixes hold after the ticket closes. As an Australian-owned partner with Australian-based support escalation and 24/7 global operations capability, Orro also connects exposure findings to the local context Australian boards are judged against, from ASD guidance to sector regulation.

In most CTEM programmes, establishing what is exposed turns out to be the faster part of the work. The harder and more valuable work sits in the stages that follow: who owns the fix, by when, and whether it held. That is where a managed programme earns its keep, particularly for security teams whose constraint is capacity, not visibility. Orro’s Continuous Threat Exposure Management service sets out how engagements are structured, and an earlier Orro piece on why exposure, not volume, should drive vulnerability priorities covers the metrics side in more depth.

The critical infrastructure thread

For organisations in critical infrastructure sectors, this is moving from good practice to something closer to evidence. The Enhanced Critical Infrastructure Risk Management Program Rules, registered in June 2026, require CIRMPs for nine asset classes, including electricity, gas, water, liquid fuel and freight, to specifically address the risks posed by unpatched systems and legacy technology, with a 12-month grace period for these core cyber risks (Clayton Utz, 2026). A functioning CTEM programme produces exactly the record a board needs before approving its annual CIRMP report: what was in scope, what was found, what was fixed, what remains open and why.

Whether, and how, the Security of Critical Infrastructure Act 2018 applies depends on each organisation’s assets, sector and responsible entity status. Obligations should always be confirmed against your specific circumstances with appropriate legal and regulatory advice.

From reaction to pre-emption

Orro’s September analysis of the recovery-denial economy pointed to continuous exposure management as the broader practice that recovery resilience depends on. The case for it has only strengthened since. Attackers are not waiting for the quarterly assessment, and the organisations that keep pace are not the ones with the most scanners. They are the ones that have made the step from finding to fixing routine, measured and owned.

CTEM is how that step becomes a habit instead of a heroic effort. It asks organisations to scope around what the business values, see their environment as an attacker would, rank by real consequence, prove what matters, and mobilise people outside the security team to act. None of that requires starting from scratch. It does require deciding that exposure reduction is a programme to be run, not a report to be received.

For a quick read on where your own programme stands, Orro’s free cyber governance maturity assessment takes about ten minutes and benchmarks your posture across five capability areas, from identify and govern through to recover and improve. It is a practical way to check whether the foundations a CTEM programme depends on are already in place. For a broader conversation about building an exposure management programme around your own priorities, Orro’s Strategy and Risk Management team is a good place to start.