Lion Cipher Lab

Run a CTEM (Continuous Threat Exposure Management) cycle from scratch, offline

• GRC / Compliance
• Advanced
• ~90 min
• Free · no account required

Why it matters

Hand a vulnerability scanner to a fresh estate and it returns ten thousand findings sorted by CVSS, and the natural instinct -- 'start at the top, patch the 9.8s' -- is wrong in a way that costs real breaches. CVSS measures how bad a vulnerability would be IF it were exploited on a worst-case system; it says nothing about whether anyone is actually exploiting it, whether the affected box is reachable, or whether losing that box matters to the business. The CVSS 9.8 that fills your top ten is often an unauthenticated bug on an internal print-adjacent workstation with an EPSS score of 0.02 --…

What you'll learn

• Running Gartner's five CTEM stages end to end -- Scoping, Discovery, Prioritization, Validation, Mobilization -- as one repeatable program cycle rather than a point-in-time scan
• Scoping a program to business-attack-surface segments (crown jewels) instead of 'all assets', and measuring how many loud-but-irrelevant exposures that removes from the queue
• Building an exposure-based prioritization score that combines exploitability (EPSS + CISA KEV), reachability (internet-facing / attack-path), and business impact (asset criticality)
• Proving with real numbers why 'patch the CVSS 9.8s first' is wrong: measuring the divergence between a naive CVSS ranking and the CTEM ranking on the same inventory
• Modelling the Validation stage -- attack-path reachability and compensating-control effectiveness -- so a mitigated CVSS 9.8 gets DEMOTED and a reachable internal host gets PROMOTED to the top
• Turning a validated, prioritized list into owner-assigned remediation with SLA tiers, and computing program metrics: % of KEV closed and exposure-reduction per cycle
• Producing a one-screen board report for a security program, and knowing when CTEM is overkill versus when it is the only honest way to answer 'are we actually exposed?'

Steps in this lab

1. What CTEM is, and the one question it exists to answer
2. Set up: one folder, one file, zero installs
3. Model the estate: assets, business criticality, and what is internet-facing
4. The exposure inventory: CVEs, misconfigurations, exposed credentials, attack paths
5. STAGE 1 -- Scoping: protect the business, not 'all assets'
6. STAGE 2 -- Discovery: enumerate the exposures on the scoped surface
7. STAGE 3 -- Prioritization: exploitability x exposure x impact, NOT raw CVSS
8. STAGE 4 -- Validation: are we ACTUALLY exposed?
9. STAGE 5 -- Mobilization: owners, SLAs, and measuring exposure reduction
10. Run it: the whole cycle, and the numbers you must reproduce
11. The judgment: why CVSS-only fails, when CTEM is overkill, and how a pro runs it

Open the full interactive lab →