{
  "publication": "EFF-WP-2026-004",
  "title": "Continuous Threat Exposure Management: a critical review and an evidence-led operating model",
  "researchCutoff": "2026-11-12",
  "citationStyle": "IEEE, numbered in order of first citation",
  "sources": [
    {
      "n": 1,
      "key": "verizon",
      "reference": "Verizon Business, \"2026 Data Breach Investigations Report,\" Verizon, Basking Ridge, NJ, USA, 2026. Accessed: Nov. 12, 2026.",
      "url": "https://www.verizon.com/business/resources/reports/dbir/",
      "verification": "Headline figure and incident period checked on the publisher page, 12 November 2026."
    },
    {
      "n": 2,
      "key": "mtrends",
      "reference": "Mandiant, \"M-Trends 2026,\" Google Cloud, Mar. 24, 2026. Accessed: Nov. 12, 2026.",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026",
      "verification": "Figures checked on the publisher page, 12 November 2026."
    },
    {
      "n": 3,
      "key": "gartner22",
      "reference": "J. D’Hoinne, P. Shoard, and M. Schneider, \"Implement a continuous threat exposure management (CTEM) program,\" Gartner, Inc., Stamford, CT, USA, Research Note, Jul. 2022. (Subscription document; not accessed directly.)",
      "url": null,
      "verification": "Not accessed directly (subscription). Stage names confirmed through public descriptions."
    },
    {
      "n": 4,
      "key": "panetta",
      "reference": "K. Panetta, \"How to manage cybersecurity threats, not episodes,\" Gartner, Inc., Aug. 2023. Archived Jan. 9, 2025.",
      "url": "https://web.archive.org/web/20250109044003/https://www.gartner.com/en/articles/how-to-manage-cybersecurity-threats-not-episodes",
      "verification": "Live page redirects; archived copy behind a bot check during preparation. Cited for the public description of the cycle."
    },
    {
      "n": 5,
      "key": "rr001",
      "reference": "Effycace Research Team, \"Exploited at the edge: What four years of confirmed attacks say about patching priorities,\" Effycace Solutions Pte Ltd, Singapore, Research Report EFF-RR-2026-001, v1.0, Nov. 2026.",
      "url": "/research/reports/exploited-vulnerabilities-2023-2026/",
      "verification": "Effycace dataset; figures copied without re-analysis."
    },
    {
      "n": 6,
      "key": "rr002",
      "reference": "Effycace Research Team, \"Severity is not a schedule: How well CVSS and EPSS predicted real exploitation,\" Effycace Solutions Pte Ltd, Singapore, Research Report EFF-RR-2026-002, v1.0, Nov. 2026.",
      "url": "/research/reports/cvss-epss-exploitation-2024-2026/",
      "verification": "Effycace dataset; figures copied without re-analysis."
    },
    {
      "n": 7,
      "key": "hevner",
      "reference": "A. R. Hevner, S. T. March, J. Park, and S. Ram, \"Design science in information systems research,\" MIS Quarterly, vol. 28, no. 1, pp. 75–105, Mar. 2004, doi: 10.2307/25148625.",
      "url": null,
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 8,
      "key": "sp80040",
      "reference": "M. Souppaya and K. Scarfone, \"Guide to enterprise patch management planning: Preventive maintenance for technology,\" Nat. Inst. Standards Technol., Gaithersburg, MD, USA, NIST SP 800-40 Rev. 4, Apr. 2022, doi: 10.6028/NIST.SP.800-40r4.",
      "url": "https://doi.org/10.6028/NIST.SP.800-40r4",
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 9,
      "key": "cvss4",
      "reference": "Forum of Incident Response and Security Teams, \"Common Vulnerability Scoring System version 4.0: Specification document,\" FIRST, Nov. 2023.",
      "url": "https://www.first.org/cvss/v4.0/specification-document",
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 10,
      "key": "allodi",
      "reference": "L. Allodi and F. Massacci, \"Comparing vulnerability severity and exploits using case-control studies,\" ACM Trans. Inf. Syst. Secur., vol. 17, no. 1, Art. no. 1, pp. 1–20, Aug. 2014, doi: 10.1145/2630069.",
      "url": null,
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 11,
      "key": "jacobs",
      "reference": "J. Jacobs, S. Romanosky, B. Edwards, I. Adjerid, and M. Roytman, \"Exploit prediction scoring system (EPSS),\" Digit. Threats: Res. Pract., vol. 2, no. 3, Art. no. 20, pp. 1–17, Jul. 2021, doi: 10.1145/3436242.",
      "url": null,
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 12,
      "key": "epss",
      "reference": "Forum of Incident Response and Security Teams, \"Exploit prediction scoring system (EPSS),\" FIRST. Accessed: Nov. 11, 2026.",
      "url": "https://www.first.org/epss/",
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 13,
      "key": "kev",
      "reference": "Cybersecurity and Infrastructure Security Agency, \"Known exploited vulnerabilities catalog,\" CISA. Accessed: Nov. 11, 2026.",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 14,
      "key": "bod",
      "reference": "Cybersecurity and Infrastructure Security Agency, \"Binding Operational Directive 22-01: Reducing the significant risk of known exploited vulnerabilities,\" CISA, Nov. 3, 2021.",
      "url": "https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities",
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 15,
      "key": "ssvc",
      "reference": "Cybersecurity and Infrastructure Security Agency, \"Stakeholder-specific vulnerability categorization guide,\" CISA, Nov. 2022.",
      "url": "https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc",
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 16,
      "key": "sheyner",
      "reference": "O. Sheyner, J. Haines, S. Jha, R. Lippmann, and J. M. Wing, \"Automated generation and analysis of attack graphs,\" in Proc. IEEE Symp. Security and Privacy, Berkeley, CA, USA, 2002, pp. 273–284, doi: 10.1109/SECPRI.2002.1004377.",
      "url": null,
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 17,
      "key": "mulval",
      "reference": "X. Ou, S. Govindavajhala, and A. W. Appel, \"MulVAL: A logic-based network security analyzer,\" in Proc. 14th USENIX Security Symp., Baltimore, MD, USA, 2005, pp. 113–128.",
      "url": null,
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 18,
      "key": "hutchins",
      "reference": "E. M. Hutchins, M. J. Cloppert, and R. M. Amin, \"Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains,\" in Proc. 6th Int. Conf. Information Warfare and Security, Washington, DC, USA, 2011, pp. 113–125.",
      "url": null,
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 19,
      "key": "attack",
      "reference": "B. E. Strom, A. Applebaum, D. P. Miller, K. C. Nickels, A. G. Pennington, and C. B. Thomas, \"MITRE ATT&CK: Design and philosophy,\" The MITRE Corp., McLean, VA, USA, Tech. Rep. MTR180360R1, Mar. 2020.",
      "url": "https://attack.mitre.org/docs/ATTACK_Design_and_Philosophy_March_2020.pdf",
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 20,
      "key": "sp800115",
      "reference": "K. Scarfone, M. Souppaya, A. Cody, and A. Orebaugh, \"Technical guide to information security testing and assessment,\" Nat. Inst. Standards Technol., Gaithersburg, MD, USA, NIST SP 800-115, Sep. 2008, doi: 10.6028/NIST.SP.800-115.",
      "url": "https://doi.org/10.6028/NIST.SP.800-115",
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 21,
      "key": "gartner23",
      "reference": "J. D’Hoinne and P. Shoard, \"Top strategic technology trends for 2024: Continuous threat exposure management,\" Gartner, Inc., Stamford, CT, USA, Research Note, Oct. 16, 2023. (Subscription document; not accessed directly.)",
      "url": null,
      "verification": "Not accessed directly (subscription). Forecast reported as described in public sources; not relied on."
    },
    {
      "n": 22,
      "key": "csf",
      "reference": "National Institute of Standards and Technology, \"The NIST Cybersecurity Framework (CSF) 2.0,\" NIST, Gaithersburg, MD, USA, NIST CSWP 29, Feb. 2024, doi: 10.6028/NIST.CSWP.29.",
      "url": "https://doi.org/10.6028/NIST.CSWP.29",
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 23,
      "key": "ir8286",
      "reference": "K. Stine, S. Quinn, G. Witte, and R. K. Gardner, \"Integrating cybersecurity and enterprise risk management (ERM),\" Nat. Inst. Standards Technol., Gaithersburg, MD, USA, NIST IR 8286, Oct. 2020, doi: 10.6028/NIST.IR.8286.",
      "url": "https://doi.org/10.6028/NIST.IR.8286",
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 24,
      "key": "cis",
      "reference": "Center for Internet Security, \"CIS Critical Security Controls, version 8.1,\" CIS, East Greenbush, NY, USA, Jun. 2024.",
      "url": "https://www.cisecurity.org/controls/v8-1",
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 25,
      "key": "iso",
      "reference": "Information Security, Cybersecurity and Privacy Protection — Information Security Management Systems — Requirements, ISO/IEC 27001:2022, International Organization for Standardization, Geneva, Switzerland, Oct. 2022.",
      "url": null,
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 26,
      "key": "mas",
      "reference": "Monetary Authority of Singapore, \"Technology risk management guidelines,\" MAS, Singapore, Jan. 2021.",
      "url": "https://www.mas.gov.sg/regulation/guidelines/technology-risk-management-guidelines",
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 27,
      "key": "sp80030",
      "reference": "Joint Task Force Transformation Initiative, \"Guide for conducting risk assessments,\" Nat. Inst. Standards Technol., Gaithersburg, MD, USA, NIST SP 800-30 Rev. 1, Sep. 2012, doi: 10.6028/NIST.SP.800-30r1.",
      "url": "https://doi.org/10.6028/NIST.SP.800-30r1",
      "verification": "Bibliographic details checked during preparation."
    },
    {
      "n": 28,
      "key": "strathern",
      "reference": "M. Strathern, \"’Improving ratings’: Audit in the British university system,\" European Review, vol. 5, no. 3, pp. 305–321, Jul. 1997, doi: 10.1002/(SICI)1234-981X(199707)5:3<305::AID-EURO184>3.0.CO;2-4.",
      "url": null,
      "verification": "Bibliographic details checked during preparation."
    }
  ]
}