I had the respect of internet hosting the primary episode of the Xposure Podcast reside from Xposure Summit 2025. And I could not have requested for a greater kickoff panel: three cybersecurity leaders who do not simply speak safety, they reside it.
Let me introduce them.
Alex Delay, CISO at IDB Financial institution, is aware of what it means to defend a extremely regulated atmosphere. Ben Mead, Director of Cybersecurity at Avidity Biosciences, brings a forward-thinking safety perspective that displays the innovation behind Avidity’s focused RNA therapeutics. Final however not least, Michael Francess, Director of Cybersecurity Superior Risk at Wyndham Resorts and Resorts, leads the cost in defending the franchise. Every introduced a novel vantage level to a standard problem: making use of Steady Risk Publicity Administration (CTEM) to advanced manufacturing environments.
Gartner made waves in 2023 with a daring prediction: organizations that prioritize CTEM shall be 3 times much less probably to be breached by 2026. However here is the kicker – provided that it is operationalized.
Talking with these seasoned defenders, we unpacked the realities and challenges behind the hype of implementing and operationalizing an efficient Publicity Administration technique, addressing the next robust questions:
- What does a superb CTEM program appear to be and what are the standard challenges that must be overcome?
- How do you optimize cyber and danger reporting to affect board-level selections?
- And finally, how do you measure the success of your CTEM program?
Challenges, Priorities, and Greatest Practices
CTEM is not plug-and-play. The panelists’ prescription was clear: begin with asset stock and identification administration; weak service accounts, over-permissioned customers, legacy logins. None of those are small gaps, they’re wide-open doorways that must be checked regularly. And for all of our panelists, frequency issues – lots. As a result of guess what? Adversaries are continually difficult defenses too. For inside belongings, weekly validation is the rule of thumb. For external-facing belongings? Each day. As they see it, it is the one method to preserve a continuing deal with over their continually altering environments.
Surprisingly, Michael pointed to menace intelligence because the spine of any safety testing program. “That you must perceive your adversaries, simulate their TTPs, and check your defenses in opposition to real-world eventualities, not simply patching CVEs.” That is the important thing distinction between CTEM and vulnerability administration. Vulnerability administration is about patching. Publicity administration is about determining whether or not your controls truly work to dam threats.
Reporting: Translating Cyber to Danger Phrases
Within the banking trade, like many different extremely regulated industries, Alex could not emphasize sufficient the must be ready to reply onerous questions requested from regulators. “You will get challenged in your publicity, your remediation timelines, and your danger therapy. And that is a superb factor. It forces readability and accountability”.
However even outdoors regulated industries, the dialog is altering. Boards don’t wish to hear about CVSS scores. They wish to perceive danger – and that is a totally completely different dialogue. Is the corporate’s danger profile going up or down? The place is it concentrated? And what are we doing about it?
Measuring Progress
Success in CTEM is not about counting vulnerabilities; Ben pinned it down when he mentioned he measures the variety of exploited assault paths his crew has closed. He shared how validating assault paths revealed dangerous safety gaps, like over-permissioned accounts and forgotten belongings. Out of the blue, danger turns into seen.
Others took it in one other route with tabletop workouts that stroll management by means of actual
assault eventualities. It isn’t about metrics, it is about explaining the danger and the results. A shift that strikes the dialogue from noise to sign, and offers the enterprise readability on what issues: the place we’re uncovered, and what we’re doing about it.
From Idea to Motion
Need to hear how these defenders are placing CTEM into motion with out drowning in noise?
This episode dives deep into the actual questions: the place do you begin, how do you keep centered on what’s exploitable, and the way do you join all of it to enterprise danger? You will hear first-hand how safety leaders like Alex, Ben, and Michael are tackling these challenges head-on, with a number of surprises alongside the best way…
🎧Be certain that to catch the complete dialog on Apple Podcast and Spotify