CAASM EASM CTEM what the acronyms mean for a security team

Security teams get handed a lot of acronyms, and three that show up constantly in vendor material and analyst reports are CAASM, EASM and CTEM. They get used loosely, sometimes interchangeably, which makes it hard to work out what each one actually does for a team on the ground. This post sets out to describe CASSM EASM CTEM what the acronyms mean for a security team, what a security team actually does with it day to day, and how the three relate to each other.

CAASM: Cyber Asset Attack Surface Management

CAASM is about inventory. It aggregates data from the tools a team already has, endpoint agents, cloud provider APIs, identity providers, vulnerability scanners, MDM, network discovery, and reconciles it into a single record per asset. The point is not to run another scan. It is to stop treating five different partial views of the estate as five different problems.

For a security team, CAASM answers a question that sounds simple but usually is not: what do we actually have, and what is on each of those assets. In most organisations no single source of truth exists for this. Different tools disagree on device counts, ownership, patch state and location, and reconciling those manually does not scale past a small estate.

Day to day, a team uses CAASM to find assets that are missing agents or scanner coverage, to close gaps between what asset management says exists and what the network actually shows, and to answer audit and incident questions quickly, such as which devices run a given piece of software, or which assets belong to a business unit that just had a breach in the news. CISA maintains a short overview of CAASM as a service category, and this breakdown of how CAASM is implemented in practice is worth a read if you want the mechanics rather than the summary.

EASM: External Attack Surface Management

EASM looks from outside in. Instead of aggregating data from internal tools, an EASM platform discovers what is reachable from the public internet: domains, subdomains, IP ranges, exposed services, certificates, cloud storage buckets left open, and forgotten infrastructure that was never decommissioned properly. It builds this picture the way an attacker doing reconnaissance would, without needing credentials or agents on anything.

This matters because internal asset inventories, however good, only cover what the team already knows to track. EASM regularly turns up assets nobody remembers provisioning: a marketing microsite spun up by an agency two years ago, a staging environment left with production data, a subdomain still pointing at a decommissioned cloud service that can be claimed by anyone. These are exactly the kind of things that get exploited precisely because they are not on anyone’s list.

A security team runs EASM continuously rather than as a one-off exercise, because the external footprint changes constantly as marketing, dev teams and third parties spin things up without necessarily looping in security. Typical use includes catching shadow IT before it becomes an incident, verifying that acquisitions and subsidiaries are not carrying unknown exposure, and feeding newly discovered external assets back into the internal inventory so CAASM has a complete picture rather than an internally sourced one.

CTEM: Continuous Threat Exposure Management

CTEM is not a tool category in the way CAASM and EASM are. It is a programme, a term coined by Gartner to describe a repeating cycle rather than a single capability. The cycle runs in five stages: scoping, discovery, prioritisation, validation and mobilisation. Scoping defines what matters to the business and what is in scope for a given cycle. Discovery finds the assets, misconfigurations and exposures. Prioritisation ranks them by exploitability and business impact rather than raw severity score. Validation tests whether an exposure is actually reachable and exploitable, often through simulated attacks or targeted penetration testing rather than trusting a scanner’s output at face value. Mobilisation is the coordination step, getting the right fix to the right owner and tracking it to closure.

For a security team, CTEM is the operating model that turns a pile of discovered exposures into a manageable, repeating workflow instead of an annual scramble. It is the difference between running a vulnerability scan and having a defined process for what happens to every finding that scan produces, who owns it, how it gets validated, and how the whole cycle repeats on a cadence rather than whenever someone remembers. CTEM.org has a detailed breakdown of the five stages along with a set of open identifiers for standardising how different exposure types get tracked, which is useful if you are trying to formalise a CTEM programme rather than just borrow the terminology.

How they fit together

These three are not competing approaches to the same problem. CAASM and EASM are both discovery mechanisms, one internal, one external, and CTEM is the process that consumes their output. A CTEM programme without CAASM or EASM feeding it is prioritising exposure against an inventory it cannot fully trust. CAASM and EASM without a CTEM process behind them produce a large, accurate list of exposures with no defined mechanism for deciding what to fix first or confirming the fix actually landed.

In practice this means CAASM and EASM sit in the scoping and discovery stages of a CTEM cycle, supplying the asset and exposure data that everything downstream depends on. This comparison of CAASM and CTEM goes into this relationship in more detail, including where the two disciplines overlap and where they clearly do not.

For a security team building or evaluating tooling, the practical takeaway is to separate these terms by what they actually give you: CAASM for internal asset truth, EASM for what an outsider can see, and CTEM for the recurring process that turns both into prioritised, tracked remediation. Treating them as interchangeable, or as three names for the same product, tends to produce gaps in exactly the areas each one is meant to cover.