The validation chain
Every finding earns its label: detected → corroborated across multiple engines → adversarially probed → assigned a state. Severity is evidence, not an estimate.
Platforms / Continuous Threat Exposure Management
Proof-driven CTEM — from discovery to validated fix
Scanners produce lists; attackers produce proof. VirtueThreatX runs all five Gartner CTEM stages in one workflow — with adversarial validation and AI/LLM exposure built in — so your team ships proven, prioritized fixes instead of more findings.
- All 5 Gartner CTEM stages in one workflow
- 49 detection engines across 10 attack surfaces
- Adversarial validation — proven exploitable, not theoretical
- Frameworks: MITRE ATT&CK · OWASP · CISA KEV · EPSS · NIST CSF · PCI DSS · SOC 2
The validation chain — how every finding earns its label
Detection is the start, not the answer. A finding is corroborated across engines, adversarially probed, then assigned one of four honest states — so only proven-exploitable exposures reach your team.
- 01
Detection
A candidate finding enters the pipeline.
- 02
Corroboration
Cross-engine agreement separates signal from noise.
- 03
Adversarial probe
A production-safe probe proves exploitability.
- 04
State assignment
The finding earns one of four honest states.
Only one state wakes your team
Validated
Proven exploitable — pages on-call with evidence
Validating
In active adversarial probe
Theoretical
Real, but not reachable
Suppressed
Audit trail only
The five CTEM stages, as one loop
01
Scope
Define the estate that matters — the assets, apps, and surfaces where exposure actually carries business risk.
02
Discover
Seedless external attack-surface discovery finds every asset, subdomain, certificate, and shadow service exposed to the internet.
03
Prioritize
Rank by real risk — KEV status, EPSS, and business context — not by raw CVSS severity.
04
Validate
Adversarial, production-safe probing proves what is actually exploitable — the stage most platforms skip.
05
Mobilize
Validated exposures open tickets with an owner and SLA, trigger response, and are tracked to a proven fix. Then the loop starts again.
Capabilities
Four honest states
Validated (proven exploitable — pages on-call with evidence), Validating (in active probe), Theoretical (real but not reachable), Suppressed (audit trail only). Only Validated wakes your team.
Surface-aware scanning
The right scanner is dispatched to the right surface — Web, API, Cloud, Identity, AI/LLM — not blasted across every asset. Higher signal, lower cost — scans dispatched only where they apply.
AI & LLM exposure — built first
Prompt-injection probing, RAG context fuzzing, shadow-AI discovery, and model-exposure scanning. The attack surface most exposure tools don't cover at all.
Re-scans only what changed
Re-scans fire on the events that actually change risk — code pushes, new KEV entries, certificate-transparency logs, cloud changes — so you see what's new, not the whole report every time.
Identity exposure management
Over-permissioned roles, leaked credentials, non-human identity sprawl, and IAM relationship walks — the identity attack paths behind most modern breaches.
Architecture
How it's built
One validation pipeline under every engine — detection, corroboration, and adversarial proof share the same evidence trail, not three tools stitched together at the reporting layer.
Discover
External attack surface management
Seedless discovery maps everything internet-exposed — assets, subdomains, certificates, shadow services — and monitors it for drift.
Detect
49 engines, 10 surfaces, dispatched by capability
Continuous, event-driven scanning across Web, API, Cloud, Identity, and AI/LLM surfaces — the right engine on the right target, corroborated across engines to separate signal from noise.
Validate
Adversarial exposure validation
Production-safe adversarial probing (BAS) plus LLM triage and KEV cross-reference prove exploitability before a finding ever reaches your queue — the platform's defining step.
Mobilize
Owner, SLA, response & retest
Validated exposures auto-open tickets with an owner and SLA, integrate with security operations, and are re-validated on change until proven fixed.
Integrations
- Scanning coverage
- 49 detection engines across 10 surfaces — Web, API, Cloud, Identity, AI/LLM, and more
- Risk-change triggers
- Git pushes, CISA KEV entries, certificate-transparency logs, CloudTrail, Kubernetes admission
- Frameworks & prioritization
- MITRE ATT&CK, OWASP Top 10, CISA KEV, EPSS, NIST CSF, PCI DSS, SOC 2
Deployment & data
Runs as a continuous exposure-management service alongside our assessment engagements. Adversarial validation is production-safe by design; scope, scan cadence, and data handling are agreed at engagement start, and findings are tenant-isolated.
Per-tenant data isolation; data-handling terms committed in your service agreement. See Trust & Company Facts.
Inside the platform
Real screens from a live demo tenant — not mockups. Client data is redacted; the interface and data model are exactly what your team works in.
app.virtueshieldx.com — live tenant data
app.virtueshieldx.com — live tenant data
What the AI does — precisely
- Autonomous
- Discovery, surface-aware scanning, and delta re-scans on risk-changing events run continuously without human initiation.
- AI-assisted
- Prioritization, LLM-assisted triage, and the exploitation forecast are AI-driven; validation logic is engineer-designed.
- Human-decided
- What enters your queue — and any active adversarial validation against production — is governed by engineer supervision and production-safe guardrails.
In service delivery
VirtueThreatX powers our vulnerability assessment and continuous testing engagements — and in the assurance loop it's the ATTACK phase's proving ground: findings our red team and pentesters confirm become validated, tracked exposures.
Vulnerability Assessment service →See it running
A guided walkthrough of the platform with the team that built it — on live data, with your questions answered in real time.