The CTEM Divide: Why 84% of Security Programs Are Falling Behind

Originally published on the Hacker News here.

A new 2026 market intelligence study of 128 enterprise security decision-makers (available here) reveals a stark divide forming between organizations – one that has nothing to do with budget size or industry and everything to do with a single framework decision. Organizations implementing Continuous Threat Exposure Management (CTEM) demonstrate 50% better attack surface visibility, 23-point higher solution adoption, and superior threat awareness across every measured dimension. The 16% who’ve implemented it are pulling away. The 84% who haven’t are falling behind.

The Demographics of the Divide

The research surveyed a senior cohort: 85% of respondents are Manager-level or above, representing organizations where 66% employ 5,000+ people across finance, healthcare, and retail sectors.

Download the full research here →

What is CTEM?

If you aren’t familiar, CTEM involves shifting from “patch everything reactively” to “continuously discover, validate, and prioritize risk exposures that can actually hurt the business.” It’s widely discussed in cybersecurity now as a next-generation evolution of exposure/risk management, and the new report reinforces Gartner’s view that businesses adopting it will consistently demonstrate stronger security outcomes than those that don’t.

Awareness Is High. Adoption Is Rare.

One surprising finding: There doesn’t seem to be a problem with awareness, just implementation. 87% of security leaders recognize the importance of CTEM, but only 16% have translated that awareness into operational reality. So, if they’ve heard of it, why aren’t they using it?

The gap between awareness and implementation reveals modern security’s central dilemma: which priority wins? Security leaders understand the CTEM conceptually but struggle to sell its benefits in the face of organizational inertia, competing priorities, and budget constraints that force impossible tradeoffs. The challenge of gaining management buy-in is one reason why we prepared this report: to provide the statistics that make the business case impossible to ignore.

Complexity is the New Multiplier

For example: Beyond a certain threshold, manual tracking of all the additional integrations, scripts, and dependencies breaks down, ownership blurs, and blind spots multiply. The research makes it clear that attack surface complexity is not just a management challenge; it’s a direct risk multiplier.

We can see this clearly in the graph below. Attack rates rise linearly from 5% (0-10 domains) to 18% (51-100 domains), then rise steeply past 100 domains.

This sudden increase is driven by the ‘visibility gap’, the gulf between the assets a company is responsible for monitoring and those it’s aware of. Each additional domain can add dozens of connected assets, and when the count climbs past 100, this can translate to thousands of additional scripts: each one a possible attack vector. Traditional snapshot security cannot hope to log and monitor them all. Only CTEM-driven programs can provide the oversight to continuously identify and validate the dark assets hiding in this visibility gap – before attackers do.

Why This Matters Now

Security leaders are currently facing a ‘perfect storm’ of demands. At a time when 91% of CISOs report an increase in third-party incidents, average breach costs have climbed to $4.44M, and PCI DSS 4.0.1 brings stricter monitoring and the ever-present specter of penalties. With this in mind, the report shows that attack surface management has become an issue for the boardroom as much as the server room, and the C-suite reader can only conclude that continuing to trust manual oversight and periodic controls to manage such a complex, high-stakes challenge would be self-destructive.

One of the clearest signals in this research comes from the peer benchmarking data. When organizations compare themselves side by side – by attack surface size, visibility, tooling, and outcomes – a pattern emerges that is difficult to ignore: beyond a certain level of complexity, traditional security approaches stop scaling.

The takeaway from the peer benchmarks is clear: below a certain level of exposure, organizations can rely on periodic controls and manual oversight. Above it, those models no longer hold. For security leaders operating in high-complexity environments, the question is no longer whether CTEM is valuable – it is whether their current approach can realistically keep up without it.

Download the full market research here.

FAQs

How does CTEM relate to web security and client-side threat visibility?

CTEM frameworks require continuous discovery of all exposed assets, including client-side ones — third-party scripts, tags, and pixels running in users’ browsers. This is an area where most security programs have significant blind spots. Web exposure management tools like Reflectiz are purpose-built to provide the continuous discovery and validation that CTEM demands on the client-side attack surface.

What is CTEM and why does it matter for enterprise security in 2026?

Continuous Threat Exposure Management (CTEM) is a security framework that shifts organizations from reactive patching to continuously discovering, validating, and prioritizing risk exposures that can cause real business harm. Gartner has endorsed it as a next-generation evolution of exposure management. A 2026 Reflectiz study of 128 enterprise security decision-makers found that organizations implementing CTEM demonstrate 50% better attack surface visibility and 23-point higher security solution adoption than those that don’t.

What measurable security improvements do CTEM adopters see vs. non-adopters?

CTEM-adopting organizations show 50% better attack surface visibility and score 23 points higher on security solution adoption metrics. Across every measured dimension in the 2026 Reflectiz study — threat awareness, solution coverage, and risk management maturity — the 16% who have implemented CTEM are consistently outperforming the 84% who haven’t.

What percentage of enterprises have actually implemented CTEM?

Only 16%, according to Reflectiz’s 2026 market research of 128 enterprise security leaders. Despite 87% of respondents recognizing CTEM’s importance, the vast majority have not translated awareness into operational reality. The study surveyed a senior cohort — 85% were Manager-level or above — at organizations where 66% employ more than 5,000 people.

Why are most security teams failing to adopt CTEM despite knowing about it?

The primary barriers are organizational inertia, competing priorities, and budget constraints. Security leaders understand CTEM conceptually but struggle to secure management buy-in when facing existing tool debt and pressure to maintain current operations. The gap between awareness (87%) and implementation (16%) reflects a strategic execution problem, not an awareness problem.