Page 213 - Cyber Defense eMagazine September 2025

• Active validation: Employing attack simulation and red-teaming to discern the genuinely
exploitable from the merely theoretical.
• Operational integration: Ensuring that findings translate into ongoing, real-world risk reduction—
not simply endless identification cycles.

Gartner projects that by 2026, organizations implementing CTEM will be three times less likely to suffer
a major breach than those relying on static, event-driven monitoring.

Analyst Perspective - Shifts in Budget, Prioritisation, and Regulation

CTEM's rise occurs in tandem with major movements in cyber risk investment and regulatory expectation:

• Budget allocation: Forrester's most recent benchmarks indicate that system defence activities—
now encompassing automation, attack surface management, and advanced vulnerability
mitigation—absorb 29% of total cybersecurity expenditure, surpassing both endpoint and cloud
defence.
• Risk-driven spending: Funding increasingly aligns to exposure analytics, identity and access
controls, and attack surface management, reflecting their actual operational impact, not merely
technical classification.
• Regulatory elevation: Policymakers internationally, including the United States Securities and
Exchange Commission and European Union authorities, are mandating risk-based vulnerability
management, specifically auditing organisations’ stewardship of so-called “immaterial” assets
(Forrester).

The era of attempting universal remediation is at an end. The imperative now is to apply finite effort to
only those exposures with genuine potential for exploitation.

The AI Catalyst - Detection to Defence at Scale

Artificial Intelligence is no longer a complementary element in enterprise defence—it is rapidly becoming
foundational. As the scale and volatility of today’s asset environment outpace manual capabilities, AI
emerges as the only viable path from detection to defence at scale. It revolutionizes asset management
through real-time monitoring and classification, enabling autonomous tools to identify and categorise
assets regardless of their location or origin. It proactively detects and triages threats, using machine
learning to uncover anomalies in low-priority or rarely accessed assets that traditional reviews often
overlook. AI also orchestrates automated responses—from patch deployment to access revocation—
delivering a speed and precision far beyond human reach. However, this advantage is not exclusive;
generative AI is equally available to adversaries, powering large-scale reconnaissance, rapid exploit
development, and automated attacks on overlooked assets. In this escalating AI arms race, defensive
automation is no longer a strategic advantage—it is a fundamental necessity.

Cyber Defense eMagazine – September 2025 Edition 213
Copyright © 2025, Cyber Defense Magazine. All rights reserved worldwide.